Compliance, regulation and data protection
Compliance means a company follows the laws and standards that apply to it. In IT, three come up most:
| Framework | What it is | Who it applies to |
|---|---|---|
| ISO/IEC 27001 | The international standard for an information security management system (ISMS), certified by an external audit. Latest edition: 2022. | Voluntary, but often required in contracts and tenders |
| Personal Data Protection Law (Saudi Arabia) | Governs collecting, using and transferring personal data. In force since September 2023 and fully enforceable from 14 September 2024, supervised by SDAIA. | Any organisation processing personal data of people in the Kingdom |
| Essential Cybersecurity Controls (ECC) | Controls from the National Cybersecurity Authority. The updated ECC-2:2024 has 108 controls. | Government bodies and operators of critical national infrastructure |
Key data-protection obligations that shape any system design: a clear privacy policy, collecting only the data you need, a record of processing activities, controls on transfers outside the Kingdom, and a data protection officer in certain cases.
In Europe, the GDPR follows similar ideas and applies to any company serving people in the EU, even from outside Europe.
Watch out“Privacy by design”: as a systems analyst, think about privacy from the requirements document, not after the build. Ask: do we really need this field? Who sees it? How long do we keep it?
Watch outThis is a simplified educational overview. Actual compliance requires the official texts from the relevant authorities and legal advice.