# Standards and Regulatory References — Privacy Law Monitoring

## Monitoring Framework Standards

### ISO 19600:2014 / ISO 37301:2021 — Compliance Management Systems
- Provides framework for systematic monitoring of regulatory changes
- Clause 4.1: Understanding the organisation and its context (regulatory environment)
- Clause 6.1: Actions to address compliance risks and opportunities
- Clause 8.2: Establishing controls for compliance obligations
- Clause 9.1: Monitoring, measurement, analysis, and evaluation

### NIST Cybersecurity Framework — Identify Function
- ID.GV-3: Legal and regulatory requirements regarding cybersecurity are understood and managed
- Applicable to privacy regulatory monitoring as part of governance

## Key Regulatory Intelligence Sources

### Global
- **IAPP Daily Dashboard**: Daily digest of global privacy developments
- **OneTrust DataGuidance**: Regulatory intelligence platform covering 300+ jurisdictions
- **DLA Piper Data Protection Laws of the World**: Annual survey with updates
- **Baker McKenzie Global Privacy Radar**: Monthly update on global privacy developments

### EU / EEA
- **EDPB website**: Guidelines, opinions, consistency decisions
- **EU Official Journal**: New legislation and amendments
- **CNIL publications**: French DPA guidance (often first-mover in EU)
- **BfDI publications**: German Federal DPA guidance

### Asia-Pacific
- **CAC website**: China regulatory announcements
- **PPC website**: Japan APPI guidance and enforcement
- **PIPC website**: Korea PIPA decisions and guidance
- **PDPC websites**: Singapore and Thailand regulatory updates
- **OAIC website**: Australian regulatory updates

### Americas
- **ANPD website**: Brazil LGPD guidance and enforcement
- **IAPP US State Privacy Legislation Tracker**: Tracks all US state privacy bills
- **CPPA website**: California Privacy Protection Agency updates

## Regulatory Change Velocity

### New Comprehensive Data Protection Laws by Year

| Year | New Laws Enacted | Notable Jurisdictions |
|------|-----------------|---------------------|
| 2018 | 3 | EU (GDPR effective), Brazil (LGPD enacted), California (CCPA) |
| 2019 | 2 | Thailand (PDPA enacted), India (PDP Bill introduced) |
| 2020 | 2 | California (CPRA), Korea (Data Three Acts) |
| 2021 | 4 | China (PIPL), Saudi Arabia (PDPL), UAE (DPL), South Africa (POPIA effective) |
| 2022 | 3 | Indonesia (PDP Law), Japan (APPI amendments effective), Connecticut/Colorado/Virginia/Utah (US states) |
| 2023 | 5 | India (DPDP Act), Vietnam (Decree 13), multiple US states |
| 2024 | 4+ | Australia (reform amendments), multiple US states, various APAC amendments |
| 2025-2026 | Ongoing | EU AI Act implementation, India DPDP Rules, further US state laws |

This velocity demonstrates the need for systematic monitoring: an average of 3-5 significant privacy law changes per year require organisational response.