# Standards and Regulatory References — Multi-Jurisdiction Matrix

## International Frameworks

### ISO/IEC 27701:2019 — Privacy Information Management
- Extension to ISO 27001/27002 for privacy management
- Provides a mapping framework between different privacy laws and controls
- Annex D maps to GDPR controller requirements; Annex F maps to GDPR processor requirements
- Serves as a common baseline for multi-jurisdiction compliance

### APEC Cross-Border Privacy Rules (CBPR) System
- Regional framework for consistent data protection standards across APEC economies
- Participating economies: Australia, Canada, Japan, Korea, Mexico, Singapore, Taiwan, United States, Philippines
- CBPR certification demonstrates baseline compliance across participating jurisdictions

### OECD Privacy Guidelines (2013 revision)
- Eight core privacy principles forming the foundation of most national privacy laws:
  1. Collection limitation
  2. Data quality
  3. Purpose specification
  4. Use limitation
  5. Security safeguards
  6. Openness
  7. Individual participation
  8. Accountability
- Useful as the common denominator when mapping across jurisdictions

### Council of Europe Convention 108+ (2018 modernisation)
- International treaty for data protection
- Ratified by 55 countries
- Provides a minimum standard that can serve as a baseline for multi-jurisdiction compliance

## Adequacy/Mutual Recognition Framework

| Recognising Body | Recognised Jurisdictions |
|-----------------|------------------------|
| EU Commission (GDPR Art. 45) | Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay, EU-US Data Privacy Framework |
| UK (UK GDPR) | EU/EEA, Adequate countries mirroring EU list, Australia (in negotiation) |
| Korea PIPC | EU/EEA, United Kingdom |
| Japan PPC | EU/EEA, United Kingdom |

## Multi-Jurisdiction Compliance Standards

### NIST Privacy Framework 1.0 (2020)
- Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P
- Jurisdiction-agnostic framework that maps to multiple privacy laws
- Useful as the organising structure for a compliance matrix

### ISO/IEC 29100:2024 — Privacy Framework
- Provides a high-level framework for privacy safeguards
- Defines privacy principles applicable across jurisdictions
- Serves as the reference architecture for multi-jurisdiction privacy programmes

## Key Differences Driving Multi-Jurisdiction Complexity

| Dimension | Variation Range | Impact |
|-----------|----------------|--------|
| Lawful bases | 6 (GDPR) to 10 (LGPD) | Requires basis-by-basis mapping |
| Children's age | 10 (Thailand) to 18 (India) | Highest threshold (18) as harmonised standard |
| Breach notification | 72 hours to 30 days | Shortest timeline (72 hours) as harmonised standard |
| Cross-border mechanisms | Adequacy to data localisation | Most restrictive (China CIIO) requires local storage |
| Penalties | THB 5M to 5% of revenue | Highest exposure drives investment priority |
| Consent granularity | General to separate consent per trigger | Most granular (China PIPL separate consent) as baseline |