ISO uh standards uh more specifically in the annex A, and we have a clause um 531 Which says legal, statutory, regulatory, and contractual requirements. So an organization needs to understand what are those requirements That are relevant for uh the business that you're in, the type of organization that you're in. So the purpose of that control is really to ensure that compliance. I still see a lot of organizations when auditing that don't really know what are the applicable laws and regulations that needs to be there. So whatever organizations should do is to start either with their legal counsel or they need to hire a lawyer to help them with that To understand what are all the laws and regulations that have an impact on the organization. That can be quite a lot depending on the organization that you're in there, but you need to uh check If you are compliant, you need to check what are the different countries that I'm working for. Are the countries, do I have all the laws and regulations? What specific clause in the law do I need to adhere to? And how have I tackled that? What are the specific processes? What are the policies that I use to be able to show that conformity So that ISO 27000 and one can really help you with that to really get a step up in that good overview of laws and regulations. Now there are a lot of key areas um especially nowadays it was different fifty years ago, but uh today There are a lot of key areas that should be considered. On the slide you see a couple of things that you really need to think about if they are applicable for your organization And let's walk through them one by one. First of all, data protection. Today there are a lot of countries. That have established data protection laws and regulations, think about the GDPR, that really aim at protecting, safeguarding data and data subjects. Organizations need to understand what is the law and regulation, and we need to have procedures and processes in place to ensure that we can protect that personal identifiable information. we can adhere to any requests that data subjects have and we can uh look at that. Related to data protection is of course privacy. Privacy, also in order to comply with certain laws, many organizations are also obliged to establish a policy for ensuring information privacy Throughout which they increase awareness of those statutory, regulatory, and business requirements regarding the treatment and protection of that personal information. So data protection and privacy usually go hand in hand. Cybercrime is another thing to consider. They encompass any illegal activity that is performed through a computer and network. And that is intended to really harm the organization system and gain unauthorized access to the data. Targeted organizations might experience financial and reputational damage In order to prevent and to respond to those activities, organizations should also establish procedures like an incident management procedure, um like uh ways uh for ethical hackers uh to provide them with information. Um so um protective measures as stated are are not considered as crime but also there you need to see what is applicable in your country. Sometimes ethical hacking um needs to uh adhere to certain um yeah specific guidelines and I'm talking from Belgium of course and Belgium it's it's only for one or two years that it's really legal uh to perform ethical hacking. Um and To communicate to an organization that you find some vulnerabilities. So you really need to check what is legal in your country that you reside and how can you take care of that in your organization. Dignital signatures is something else that is really something of the last years. We used to sign everything in paper. That time is far behind us. So an electronic signature today is um it it helps organizations of course to verify the um authenticity of a message or a document and by verifying the author. To check if the content has been modified. As a result, an electronic document that is digitally signed has the same legal validity as a hard copy. So, like a document document that is signed in handwriting, as long as there are regulations that give that full legal value to it. And some countries Electronic records must ensure the um preservation of uh traces as evidence of that integrity. So there you need to see okay what is the tool that we are going to use To provide those dignity, what are the certificates, for example, that are used, and what is the law again that we need to look at Intellectual property is something that you need to think about, both your own intellectual property and what how do you work with customers and how is intellectual property taken care of there, but also the intellectual property of your employees. Ensure that you have everything written down in contracts so that There is no reason to come to a conclusion later. Also, there I see a lot of companies that take care of the intellectual property with their customers, but forget that their employees also have intellectual property. Electronic payments. If your organization has a web store or something like that, electronic payments laws have been created as well. So you need to check if there is something that you need to adhere to there in ensuring that you protect the rights of the clients of which you receive those electronic payments. And then lastly we have the records management. Some national laws also require from organizations that they establish procedures for identifying, classifying, storing, modifying, and even destroying records ISO 15489. 1 delivers those specific contents or concepts and guidance that can help you in that records. So you see there are a lot of um key areas that you need to consider uh because there are a lot of uh relevant laws that might be there. So after um the so now we've spoken about the key areas Let's dive a little bit deeper into all the information security and data protection laws by region. For sure, not all of the laws have been added because that would lead us a little bit too far, of course. But um you do well um especially also when you're auditing um to uh have a general understanding about general laws that are applicable for on a country level at least And then you can still have a look. Companies need to know what is specifically for their industry applicable. So let's start with America, starting with North America. You have, of course, the HIPAA, which is the health insurance Portability and Accountability Act. It regulates the privacy and security of medical information in the United States So that's very specific for the United States. A lot of companies that are working in the United States and that have have their headquarters in the United States put those requirements also on European organizations. So it's not because it's applicable in the US that everybody who's residing in the EU is no longer falling under it. So HIPAA might be something that you need to take in. into account. So if you're auditing a finance company, that might be something that you want to check upon. Surveyus Oxley Act, a well-known act, short SOX regulates financial reporting and auditing requirements for public organizations in the United States. So public organization The California Consumer Privacy Act, the CCPA, that comes back if you're working with um US organizations, which is Is a little bit similar like the GDPR. It regulates how organizations handle California residents' personal information So it's only applicable to California. The New York State Department of Financial Services Cybersecurity Regulation, in short, 23 NYCRR 500 Requires financial institutions to establish and maintain a cybersecurity program. Personal Information Protection and Electronic Documents Act, which is called PIPEDA Regulates how Canadian private sector organizations collect, use, and disclose personal information And then lastly, the Personal Information Protection Act, in short, PIPA, is a privacy law that governs the collection, use and disclosure of personal information by private sector organizations in British Columbia and Canada. So you see and the difficulty in North America is of course you have different states and different states have different laws, so you really need to have a look on, okay, what are the laws that they're uh looking at. Then uh jumping over um to South America, um there are also a couple of things that are in place. Um so in Brazil You have the General Personal Data Protection Act, and it's a data protection law that regulates the processing of personal data in Brazil. So it applies to both Brazilian but also foreign organizations that process personal data of individuals that are located in Brazil. In Argentina, you also have a personal data protection law, uh, which is number uh 25326 And that addresses the collection, processing, storage, and transfer of personal data. And under this law, individuals have the right to access, modify, and delete their personal data held by the data controllers as well as the right to object for the processing. So you see a lot of things coming back that were also part of the GDPR And then you have in Peru also the data protection law, a Peruvian law that regulates the processing of personal data by individuals and organizations. And the law aims to protect basically the privacy of individuals by establishing principles and requirements for collection, use, storage, and transfer of personnel. Looking at Europe, um, first of all, the GDPR, well known, regulates the privacy and security of personal information for individuals within the European Union. The NIST2 Directive is an initial EU-wide legislation on cybersecurity designed to attain a uniform and elevated level of cybersecurity throughout the member states. And then we also have the EU Cybersecurity Act, which creates basically a unified system for certifying ICT products, services, and processes related to cybersecurity in Europe. Then going to the other side of the globe, Asia. In China, there is a cybersecurity law which regulates the security of networks and personal information. In China. In Singapore, we have the Personal Data Protection Act, which regulates again the collection, use, and disclosure of personal data in Singapore. In India, we have the Information Technology Act, regulates electronic transactions and digital signatures in India. In Japan, we have the Act on the Protection of Personal Information, which regulates the handling of personal information in Japan. And also in Japan, we have the basic act on cybersecurity. Which establishes basic policies for Japan's cybersecurity efforts and it formulates also a cybersecurity strategy and it effectively advances cybersecurity initiatives. In Africa, South Africa, we have the protection of personal information, is also a data protection law in South Africa, and it applies to any individual or legal entity that handles personal data. In Mauritius, we have the Cybersecurity and Cybercrime Act of 2021. That's a law that deals with cybercrime and cybersecurity. So the act provides also for different penalties based on the severity of course of the offense committed and it can include a fine not exceeding two million uh rupees and imprisonment even um for a term um not exceeding 25 years so that That's already pretty hefty. In Tunisia, we have the Organic Act number 2463 on the protection of personal data. It's a primary legal framework for data protection in Tunisia. In Ghana, we have the Cybersecurity Act 2020. It promotes a safe and a secure digital environment and it also protects critical information infrastructures and combats cybercrime in Ghana. In Kenya, we have the Data Protection Act 2019, which regulates the processing of personal data and seeks to safeguard the privacy and data protection of individuals in Kenya. And then we have in Nigeria the data protection regulation, in short, NDPR, established in 2019. It's really the first comprehensive Data protection regulation in Nigeria, and it sets out the legal framework for again the protection of personal data in Nigeria. And then we still have Oceania left. There we have the Privacy Act 1988, which governs the handling of personal information by Australian government agencies and private organizations. So it requires organizations really to have a privacy policy, but also to obtain consent for collecting personal information and to provide access to those individuals to their own personal information. To assure that their personal information remains accurate, of course. In New Zealand, we have the Privacy Act 2020, which regulates the collection and disclosure of personal information in New Zealand. It applies to all organizations, also including Including government uh agencies. And then in Fiji we had the Cybercrime Act of uh 2001, um the which was enacted by the Fiji government um and that criminalizes range of cyber offenses, including the unauthorized access to computer systems, cyber stalking and cyberbullying. So uh a lot of uh laws that um and acts that have been uh put in place uh across the globe. So When working internationally, it's a smart thing to check where are we working, where are we data transferring to and what potential legislation might be in place So you can reach out to legal counsel, to sector industry bodies that can help you understand what are the different legislations that are applicable.