GRCLibrary.ai

Document type

Annexes

66 documents. Jurisdiction- and sector-specific overlays that extend a parent document.

Documents, 66

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • Australia AI Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of Australia's approach to artificial-intelligence governance. Like Canada and unlike the European Union, Australia has no comprehensive AI statute: its approach is a voluntary-and-principles-based regime built on largely technology-neutral existing law, with one binding AI-adjacent amendment (a Privacy Act automated-decision transparency obligation). This annex presents the national strategy, the voluntary principles, standard, and current adoption guidance, and the binding privacy amendment, stating each instrument's status (voluntary, strategy, or binding) accurately. It cites the instruments by reference and cross-references the privacy layer rather than restating it.
  • California CCPA Automated Decision-Making Technology (ADMT) Regulatory RequirementsAIThis annex documents California's AI-specific regulatory limb for the AI-domain reader: the California Privacy Protection Agency's CCPA regulations on Automated Decisionmaking Technology (ADMT), which bind a business that uses ADMT to make a significant decision concerning a consumer. It is the ai/jurisdictions/ view of that limb, parallel to the Colorado and New York City AI annexes, and it adds the framework-alignment crosswalk (NIST AI RMF 1.0, ISO/IEC 42001:2023) for AI-governance adopters. This annex is the single canonical home for the CCPA ADMT limb: privacy/jurisdictions/annex-privacy-united-states.md touches ADMT only in a brief privacy-context summary that points here, and it retains the CCPA risk-assessment and cybersecurity-audit slices as its own privacy-domain obligations; on the shared ADMT obligation detail the enacted regulation governs.
  • Canada AI Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of Canada's approach to artificial-intelligence governance. Unlike the European Union or Colorado, Canada has no in-force comprehensive AI statute: the proposed federal Artificial Intelligence and Data Act (AIDA) lapsed (see below), so Canadian AI governance is a patchwork of a binding federal public-sector directive, federal soft-law for industry, a sector-specific financial-services guideline, a provincial public-sector statute, and a voluntary national standard. This annex presents each instrument, states its status accurately (what is in force, what is future-effective, and what is voluntary), and frames which obligations land on the adopter. It cites the instruments by reference and cross-references the privacy layer rather than restating it.
  • Colorado AI and Automated Decision-Making Technology Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of Colorado's artificial-intelligence statute, the first US-state AI law of its kind. Colorado is a two-regime jurisdiction: the original Colorado Artificial Intelligence Act (Senate Bill 24-205, C.R.S. 6-1-1701 et seq.) was repealed and re-enacted with substantial amendments by Senate Bill 26-189 (Automated Decision-Making Technology), so an adopter must track both the outgoing SB24-205 framework and the incoming SB26-189 framework that governs consequential decisions made on or after 1 January 2027. This annex presents both regimes, flags the material differences between them, and frames which obligations land on the adopter as developer or deployer. It cites the enacted texts and cross-references the litigation status rather than restating it.
  • European Union AI Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of the European Union artificial-intelligence framework, Regulation (EU) 2024/1689 (the "AI Act"). The corpus already carries the operational substance of the AI Act scattered across the AI-governance documents: the risk-tier classification model, the deployer obligation chain, and the general-purpose AI (GPAI) obligations all live in ai/policy-ai-compliance.md, and the fundamental-rights impact assessment sits in the unified router ai/procedure-integrated-ai-and-privacy-assessment.md. This annex consolidates that content by cross-reference rather than restating it, and adds the per-regime framing an adopter needs to see the whole jurisdiction at once: the operator roles, the applicability timeline, the penalty structure, and which obligations land on the adopter as provider, deployer, importer, or distributor.
  • Illinois AI in Employment (HB 3773) Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of Illinois's AI-in-employment law, House Bill 3773 (Public Act 103-0804), effective 1 January 2026. Unlike the comprehensive Texas and Colorado state AI statutes, HB 3773 is a targeted amendment to an existing civil-rights statute: it changes two sections of the Illinois Human Rights Act (IHRA), 775 ILCS 5, to make discriminatory employer use of artificial intelligence, the use of zip codes as a proxy for protected classes, and the failure to notify an employee of AI use each a "civil rights violation" under the IHRA employment article. Its nearest corpus sibling in subject is the New York City automated-employment-decision-tool annex (employment decisions), not the Colorado or Texas comprehensive-statute annexes. This annex frames the amendment's provisions and cross-references the operational substance rather than restating it; the controlling text is Public Act 103-0804 as codified in 775 ILCS 5.
  • Malaysia National Guidelines on AI Governance and Ethics (AIGE)AIThis annex gives the adopter a single per-framework view of Malaysia's National Guidelines on AI Governance and Ethics (AIGE). It presents the Guidelines as a voluntary framework that an organization may take up to demonstrate responsible AI governance in Malaysia. Like the Singapore annex (ai/jurisdictions/annex-ai-singapore.md), and unlike the binding annexes in this corpus (for example the EU AI Act annex, ai/jurisdictions/annex-ai-european-union.md), it is deliberately NOT a binding-obligation annex: the Guidelines create no legal duty, and an adopter's binding Malaysian obligations for personal data sit in the Personal Data Protection Act, covered in privacy/jurisdictions/annex-privacy-malaysia.md.
  • New York City Automated Employment Decision Tool Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of New York City Local Law 144 of 2021, a narrow, in-force, municipal law governing the use of an automated employment decision tool (AEDT) in hiring and promotion within New York City. It is distinct from a broad AI-risk or consequential-decision statute: it regulates one class of tool (an AEDT) used for one class of decision (an employment decision) and turns on two obligations, an annual independent bias audit and a candidate notice. This annex presents those obligations, cites the enacted rule, and cross-references the version-sensitive in-force date rather than restating it.
  • Singapore IMDA Model AI Governance Framework for Agentic AIAIThis annex gives the adopter a single per-framework view of Singapore's Model AI Governance Framework for Agentic AI (the MGF for Agentic AI). It presents the Framework as guidance and best practice that an organization may take up voluntarily to demonstrate trustworthy governance of agentic AI systems. It is deliberately NOT a binding-obligation annex: unlike the EU AI Act annex (ai/jurisdictions/annex-ai-european-union.md) or the Colorado annex (ai/jurisdictions/annex-ai-us-colorado.md), the Framework is a voluntary model framework, not legislation, so this annex frames its four dimensions as recommended practices an adopter may map to its own AI-governance controls, never as legal obligations. It is the agentic-AI companion to the generative-AI annex (ai/jurisdictions/annex-ai-singapore.md); the two are separate frameworks, each with its own per-framework annex.
  • Singapore Model AI Governance Framework for Generative AIAIThis annex gives the adopter a single per-framework view of Singapore's Model AI Governance Framework for Generative AI. It presents the Framework as guidance and best practice that an organization may take up voluntarily to demonstrate trustworthy generative-AI governance. It is deliberately NOT a binding-obligation annex: unlike the EU AI Act annex (ai/jurisdictions/annex-ai-european-union.md) or the Colorado annex (ai/jurisdictions/annex-ai-us-colorado.md), the Framework is a voluntary model framework, not legislation, so this annex frames its nine dimensions as recommended practices an adopter may map to its own AI-governance controls, never as legal obligations.
  • South Korea AI Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of South Korea's comprehensive national AI statute, the Framework Act on the Development of Artificial Intelligence and Establishment of Trust (widely cited as the "AI Basic Act"), Law No. 20676, enacted 21 January 2025 and in force since 22 January 2026. It sits alongside the other ai/jurisdictions/ annexes and is the corpus's first binding-statute annex for the Asia-Pacific region (Singapore's is a voluntary framework). In shape the Act resembles the EU AI Act more than the US state laws, a risk-tiered ("high-impact AI"), economy-wide, extraterritorial statute carrying transparency, safety, and human-oversight duties, but it is materially lighter: a promotion-first framework law whose binding duties are few, whose operative thresholds are largely delegated to Presidential Decree, and whose maximum administrative fine is 30 million won. This annex frames the Act's provisions and cross-references the operational substance rather than restating it.
  • Texas Responsible Artificial Intelligence Governance Act (TRAIGA) Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of Texas's comprehensive state AI statute, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), HB 149 of the 89th Legislature (2025), effective 1 January 2026. It sits alongside the other ai/jurisdictions/ US-state annexes (Colorado, California, New York City). Colorado is a two-regime jurisdiction (see ai/jurisdictions/annex-ai-us-colorado.md): the outgoing Senate Bill 24-205 framework (signed 17 May 2024; implementation postponed to 30 June 2026 and enforcement currently frozen pending litigation) casts the core duty as reasonable care to avoid algorithmic discrimination, backed by a deployer risk-management policy and program and an impact assessment, and the incoming Senate Bill 26-189 framework, which repeals and re-enacts it for consequential decisions made on or after 1 January 2027, recasts the core duty as documentation, record-keeping, and point-of-interaction and post-adverse-outcome disclosure for automated decision-making technology. TRAIGA takes a different shape from both: it is organized around a set of intent-based prohibited uses that bind any covered person, a narrower set of prohibitions specific to governmental entities, an AI-interaction disclosure duty that falls primarily on governmental agencies (with a separate duty on health-care providers), a regulatory sandbox, and an advisory council, and it preempts local AI regulation. This annex frames those provisions and cross-references the operational substance rather than restating it; the controlling text is HB 149 as codified.
  • United Kingdom Pro-Innovation AI Regulation Framework (CP 815 and CP 1019)AIThis annex gives the adopter a single per-regime view of the United Kingdom's approach to regulating AI: a principles-based framework that existing sector regulators interpret and apply within their own remits, rather than a single AI statute. It rests on two government documents: the AI regulation white paper, "A pro-innovation approach to AI regulation" (CP 815, March 2023), which set out the framework, and the government's response to the consultation on it (CP 1019, February 2024), which confirmed the approach and records the current position. It is deliberately NOT a binding-obligation annex in the sense of the EU AI Act annex (ai/jurisdictions/annex-ai-european-union.md): the principles bind no one directly. What binds an adopter in the UK is existing law as applied by the regulator for its sector, including data-protection law, covered in privacy/jurisdictions/annex-privacy-united-kingdom.md.
  • United States Federal AI Policy (OMB M-25-21, M-25-22, and M-26-04) Regulatory RequirementsAIThis annex gives the adopter a single per-regime view of United States federal executive-branch AI policy: three Office of Management and Budget (OMB) memoranda, M-25-21 on federal agency use of AI, M-25-22 on federal acquisition of AI, and M-26-04 on the Unbiased AI Principles for agency-procured large language models (LLMs), set against America's AI Action Plan (July 2025) and Executive Order 14365 on state AI laws. It sits alongside the ai/jurisdictions/ US-state annexes (California, Colorado, Illinois, New York City, and Texas).
  • BASC Programme Overview AnnexComplianceThis annex provides the programme overview for organizations that pursue or maintain Business Alliance for Secure Commerce (BASC) certification. BASC is a private supply-chain security certification run by the World BASC Organization (WBO), a member-led business organization, and is widely adopted in Latin American trade and logistics operations. By BASC's own account, its International Norm V6-2022 is meant to help a company implement and complement programmes such as CTPAT and the Authorized Economic Operator (AEO) (clause 1.1 e), and it lists the World Customs Organization (WCO) Framework of Standards among its normative references (clause 2). In clause 0.1 (Prologue) of the same Norm, BASC states that it has cooperation agreements with 22 business and customs organizations, the WCO among them. That cooperation agreement is BASC's own account and does not by itself establish recognition: BASC is not recorded in the WCO SAFE Framework (2025 edition), and recognition of BASC by the WCO is not confirmed by a held source.
  • Canada Public Sector GRC Requirements AnnexComplianceThis annex is the Canada-specific public-sector carrier for the GRC library. It supplements the jurisdiction-neutral compliance/public-sector/annex-public-sector-requirements.md by organizing Canadian federal, provincial, territorial, municipal or local, contractor, health-information, financial-sector, and private-sector applicability boundaries.
  • DORA Implementation AnnexComplianceThis annex describes how a financial entity in scope of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) can use the core GRC library to implement the five DORA pillars. The annex maps the library to each pillar, identifies the supplementary supervisory artefacts DORA requires, and notes the obligations specific to critical ICT third-party service providers.
  • eIDAS Sector Requirements AnnexComplianceThis annex describes how an organization in scope of the EU electronic identification and trust services framework (eIDAS) can use the core GRC library to meet its obligations, and where the framework requires artefacts and processes the library does not itself produce. The governing instrument is Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (the European Digital Identity Framework, commonly "eIDAS2"), which introduced the European Digital Identity Wallet, the wallet-relying-party regime, and a strengthened trust-services and supervision model.
  • Energy and Utilities Sector Requirements AnnexComplianceThis annex describes how organizations operating in energy generation, transmission, distribution, supply, oil and gas, drinking water, waste water, and district heating can use the core library while satisfying the overlay obligations imposed by sector-specific regulators and standards. It covers operational technology (OT) and industrial control system (ICS) cybersecurity, critical-infrastructure-protection standards, sector incident reporting, physical-cyber convergence, and supplier and component security particular to energy and utilities.
  • FedRAMP Sector Requirements AnnexComplianceThis annex describes how a cloud service provider seeking US Federal Risk and Authorization Management Program (FedRAMP) authorization can use the core GRC library to demonstrate the control set, evidence, and operating expectations FedRAMP requires. The annex maps the library to FedRAMP baselines, identifies applicability triggers, describes the authorization routes, and lists the supplementary documentation FedRAMP requires beyond the library's baseline.
  • Financial Services Sector GRC Requirements AnnexComplianceThis annex identifies the additional GRC obligations that apply to organizations operating in or adjacent to the financial services sector. It maps applicable regulatory frameworks to the core GRC library controls and identifies gap areas requiring sector-specific supplementation.
  • Healthcare Sector GRC Requirements AnnexComplianceThis annex identifies the additional GRC obligations that apply to organizations operating in or adjacent to the healthcare sector. It maps applicable regulatory frameworks to the core GRC library controls and identifies gap areas requiring sector-specific supplementation.
  • Logistics Sector GRC Requirements AnnexComplianceThis annex identifies the additional GRC obligations that apply to organizations operating in the transportation and logistics sector. It maps applicable regulatory frameworks to the core GRC library controls and identifies gap areas requiring sector-specific supplementation.
  • MiCA Implementation AnnexComplianceThis annex describes how an entity in scope of the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, "MiCA") can use the core GRC library to implement its obligations as an issuer of asset-referenced tokens, an issuer of e-money tokens, or a crypto-asset service provider. The annex maps the library to MiCA's structure by crypto-asset category and by service, identifies the supervisory artefacts MiCA requires, and notes the phased application timeline.
  • NIS 2 Implementation AnnexComplianceThis annex describes how an entity in scope of EU Directive (EU) 2022/2555 (NIS 2) can use the core GRC library to implement the cybersecurity risk-management measures and the incident reporting obligations the directive imposes. It identifies the entity classification, the article-by-article mapping to library artefacts, the management body responsibilities, and the supplementary documentation that NIS 2 transposing laws require beyond the library baseline.
  • Public Sector GRC Requirements AnnexComplianceThis annex identifies the obligations that overlay the core GRC library when an entity is a public sector body or a contractor providing services to one. It covers freedom of information, accessibility, public procurement, records management, audit and transparency, official languages, lobbying and ethics, and the elevated expectations on technology, AI, and data protection that public sector buyers and citizens apply.
  • SOX IT General Controls AnnexComplianceThis annex describes how organizations subject to the Sarbanes-Oxley Act (SOX) sections 302 and 404, or equivalent financial-reporting integrity regimes elsewhere (J-SOX in Japan, C-SOX in Canada, equivalents), can use the core GRC library to demonstrate IT General Controls (ITGC) supporting Internal Control over Financial Reporting (ICFR). The annex maps the library to the four ITGC domains, identifies the auditor expectations, and lists the artefacts that adopting entities must produce alongside the library to evidence operating effectiveness.
  • Telecommunications Sector Requirements AnnexComplianceThis annex identifies the overlay obligations that apply when the organization operates a public electronic communications network or service, or provides services that depend on one. It covers network security, lawful interception, data retention, emergency calling and resilience, vendor and supply-chain restrictions, customer privacy under sector-specific rules, and number- and addressing-resource obligations.
  • UK AEO-S IT and Cybersecurity RequirementsComplianceIn the UK Authorized Economic Operator (AEO) programme, HMRC tests applicants against the security and safety criteria (UK HMRC AEO security and safety criteria handbook, section 11.1). That Border Force administers the programme is not confirmed by a held source, and the trade facilitation benefits the programme grants are not recorded in the handbook's section 11. The WCO AEO Compendium (2020) United Kingdom entry lists no benefits and names its programme "AEO (European Union Programme)"; the benefits the Compendium's European Union entry lists under the Union Customs Code are not confirmed for the current UK programme. Confirm both with HMRC before relying on them. Under the AEO-S (Authorized Economic Operator Security and Safety) criteria, the applicant's procedures are to be documented and made available for HMRC during the audit of the AEO criteria (section 11.1), its security and safety risk assessment is to address, among other areas, its computer system, accounting records and documents (section 11.2), and it must be able to produce documentation showing the measures and controls it has put in place (section 11.3). The handbook's section 11 does not name cybersecurity or IT security controls; the IT security measures the held handbook names sit under the record keeping criterion, which section 1.4 lists among the AEO-S criteria: appropriate information technology security measures to protect computer systems from unauthorized intrusion and to secure documentation and data (section 8.1), with detail under back-up, recovery, fallback and archiving (section 8.9), protection of computer systems (section 8.10), access rights procedures (section 8.11) and documentation security (section 8.12). The mapping of each control below to those sections is the organization's own; where no held section names a control, as with multi-factor authentication and encryption, this annex treats it as the organization's own scoping of the criteria, to be confirmed with HMRC. This annex defines the organization's IT and cybersecurity controls relevant to AEO-S compliance and maps them to the corresponding GRC library documents.
  • United States HIPAA Sector Requirements AnnexComplianceThis annex describes how an organization subject to the US Health Insurance Portability and Accountability Act (HIPAA) can use the core GRC library to meet HIPAA's operational obligations, and where HIPAA requires artefacts and processes the library does not itself produce. It deepens the sector-generic healthcare annex into a rule-by-rule operational view: role determination, the Security Rule safeguard families, the Privacy Rule use-and-disclosure core, the Breach Notification Rule mechanics and timelines, the enforcement and penalty structure, and the mapping of these obligations to library documents through the NIST SP 800-66r2 implementation crosswalk.
  • Building Management Systems (BMS) Overlay AnnexOperationsThis annex provides BMS-specific security considerations that overlay the OT/ICS Security Standard (operations/ot/standard-ot-ics-security.md). BMS are a subset of OT and are governed by that standard; this annex identifies where BMS environments need additional or differentiated controls due to life-safety integration, tenant impact, regulatory authority oversight, and the characteristic vendor and integration patterns of modern smart-building deployments.
  • Operational Technology Security Overview AnnexOperationsThis annex provides the conceptual foundation for the library's Operational Technology (OT) security content. It defines OT scope, distinguishes OT from IT, introduces the dominant reference frameworks (IEC 62443 and NIST SP 800-82), and explains the zone-and-conduit model that underpins OT network architecture.
  • Australia Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Australia under the Privacy Act 1988. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Brazil Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Brazil under the Lei Geral de Proteção de Dados Pessoais (LGPD). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Canada Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to processing of personal data in Canada under PIPEDA (current), the lapsed Consumer Privacy Protection Act and Artificial Intelligence and Data Act (Bill C-27, which died on the 2025-01-06 prorogation; a privacy successor, Bill C-36 (Protecting Privacy and Consumer Data Act), was introduced 2026-06-15 and is proposed, not in force; see below), and Quebec Law 25. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Chile Privacy Regulatory RequirementsPrivacyThis annex defines the privacy regulatory requirements applicable to the processing of personal data (tratamiento de datos de carácter personal) in Chile under Ley 19.628 sobre protección de la vida privada. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. Ley 19.628 governs processing in registros or bancos de datos by both public bodies and private parties, excluding processing done in the exercise of the freedoms of opinion and information [Art. 1].
  • China Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in China under the Personal Information Protection Law (PIPL), Cybersecurity Law (CSL), and Data Security Law (DSL), and the Generative AI Regulations. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Colombia Privacy Regulatory RequirementsPrivacyThis annex defines the privacy regulatory requirements applicable to the tratamiento (processing) of personal data in Colombia under Ley Estatutaria 1581 de 2012 and its reglamentary stack, principally Decreto 1377 de 2013 as compiled into the Decreto Único Reglamentario 1074 de 2015 (Capítulo 25), together with the Registro Nacional de Bases de Datos rules (Capítulo 26, compiling Decreto 886 de 2014 as modified by Decreto 90 de 2018) and the Normas Corporativas Vinculantes rules (Sección 7, added by Decreto 255 de 2022). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. Ley 1581 applies to personal data registered in any database that makes them susceptible to tratamiento by public- or private-nature entities, to tratamiento carried out in Colombian territory, and to a controller or processor not established in Colombia where Colombian law applies to it by virtue of international norms and treaties [Ley Art 2].
  • Ecuador Privacy Regulatory RequirementsPrivacyThis annex defines the privacy regulatory requirements applicable to the tratamiento (processing) of personal data in Ecuador under the Ley Orgánica de Protección de Datos Personales (LOPDP) and its Reglamento General, issued by Decreto Ejecutivo 904. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. The LOPDP applies to the tratamiento of personal data held in any type of medium, automated or not, and to every later form of use, except in the cases the same article excludes [Ley Art 2]. Without prejudice to the rules established in the international instruments ratified by the Ecuadorian State that concern this matter, it applies where the tratamiento takes place anywhere in the national territory, where the controller (responsable) or processor (encargado) is domiciled there, where a controller or processor not established in Ecuador processes the data of data subjects (titulares) residing in Ecuador and the processing relates to offering them goods or services, whether or not payment is required, or to monitoring their behaviour in Ecuador, and where Ecuadorian law applies to a controller or processor not domiciled in Ecuador by contract or by public international law [Ley Art 3].
  • European Union Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data of individuals in the European Union under the GDPR and the EU AI Act. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • India Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in India under the Digital Personal Data Protection Act 2023 (DPDPA) and the Digital Personal Data Protection Rules 2025. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Indonesia Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Indonesia under the Personal Data Protection Law (UU PDP) No. 27 of 2022. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Japan Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Japan under the Act on the Protection of Personal Information (APPI). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Kenya Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Kenya under the Data Protection Act 2019. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Latin America Privacy Regulatory RequirementsPrivacyThis annex provides an overview of privacy regulatory requirements in key Latin American jurisdictions beyond Brazil: Argentina, Mexico, Colombia, Chile, Peru, and Ecuador. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. For Brazil-specific requirements, see privacy/jurisdictions/annex-privacy-brazil.md.
  • Legitimate Interest Assessment for Employment Monitoring AnnexPrivacyThis annex specializes the general Legitimate Interest Assessment (LIA) method for one context: the monitoring of personnel and their devices on organization systems and networks. It operationalizes, for that context, the three-part test defined in the Legitimate Interest Assessment (LIA) Template, and it is the privacy-analysis companion to the Workforce Network Monitoring Policy.
  • Malaysia Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Malaysia under the Personal Data Protection Act 2010 (Act 709) as amended in 2024. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Mexico Privacy Regulatory RequirementsPrivacyThis annex defines the privacy regulatory requirements applicable to the processing of personal data held by private parties in Mexico under the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • New Zealand Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in New Zealand under the Privacy Act 2020. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Nigeria Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Nigeria under the Nigeria Data Protection Act 2023 (NDPA). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Peru Privacy Regulatory RequirementsPrivacyThis annex defines the privacy regulatory requirements applicable to the processing (tratamiento) of personal data in Peru under Ley Nº 29733, Ley de Protección de Datos Personales, and its regulation, Decreto Supremo Nº 016-2024-JUS. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure. Ley 29733 applies to personal data contained in, or destined for, public- and private-administration data banks (bancos de datos personales) processed in the national territory, with sensitive data an object of special protection [Ley Art 3].
  • Philippines Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in the Philippines under Republic Act No. 10173 (Data Privacy Act 2012). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Privacy Jurisdiction IndexPrivacyThis index provides navigation to jurisdiction-specific privacy and AI regulatory requirement annexes and a cross-jurisdiction compliance mapping summary. Each jurisdiction file covers applicable laws, privacy obligations (and AI obligations where the jurisdiction addresses them), cross-border transfer mechanisms, and enforcement authorities and fines.
  • Saudi Arabia Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Saudi Arabia under the Saudi Personal Data Protection Law (PDPL). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Singapore Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Singapore under the Personal Data Protection Act 2012 (PDPA). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • South Africa Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in South Africa under the Protection of Personal Information Act, 2013 (POPIA). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • South Korea Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in South Korea under the Personal Information Protection Act (PIPA). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Switzerland Privacy Regulatory RequirementsPrivacyThis annex defines privacy regulatory requirements applicable to the processing of personal data in Switzerland under the New Federal Act on Data Protection (nFADP/revDSG). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Thailand Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Thailand under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Turkey Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in Turkey under the Law on the Protection of Personal Data (KVKK). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • United Arab Emirates Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in the United Arab Emirates (UAE) under the UAE Personal Data Protection Law (PDPL) and the DIFC and ADGM free zone frameworks. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • United Kingdom Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to the processing of personal data in the United Kingdom under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (DUAA 2025; c. 18). It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • United States Privacy Regulatory RequirementsPrivacyThis annex defines privacy and AI regulatory requirements applicable to processing of personal data in the United States under the FTC Act, federal sector-specific laws, and state comprehensive privacy laws. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • Vietnam Privacy Regulatory RequirementsPrivacyThis annex defines privacy requirements applicable to the processing of personal data in Vietnam under the Law on Personal Data Protection No. 91/2025/QH15 (PDPL) and Decree No. 356/2025/ND-CP, both in force from 2026-01-01, including the AI-related provisions those two instruments themselves contain. It supplements the Privacy and Data Governance Policy and the Privacy Impact and Cross-Border Transfer Procedure.
  • AI-Specific Risk Methodology AnnexRiskThis annex extends the enterprise risk assessment methodology in risk/procedure-risk-assessment-methodology.md with AI-specific risk dimensions, assessment criteria, and treatment guidance. It supports consistent identification, scoring, and management of risks arising from the development, deployment, and use of AI systems across the organization.
  • Trade and Supply-Chain Continuity Controls AnnexSupply chainThis annex provides organization-neutral continuity considerations for trade, logistics, customs, cargo, and supply-chain operations. It supports continuity planning where disruption to external routes, facilities, suppliers, documents, customs data, or service providers may affect critical operations.

With script, All Documents, filtered to Annexes, lists these 66 documents, and the area chips holding any of them, and its text filter, narrow them further.