# Standards and Regulatory References — Privacy Law Gap Analysis

## Frameworks for Gap Analysis

### ISO/IEC 27701:2019
- Provides a privacy management system that maps to multiple privacy laws
- Annex D (controller mapping) and Annex F (processor mapping) serve as gap analysis templates
- Gap analysis against ISO 27701 provides a jurisdiction-agnostic baseline

### NIST Privacy Framework 1.0 (2020)
- Functions (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P) provide structured categories
- Gap analysis can be conducted function by function
- Current Profile vs Target Profile methodology aligns with gap analysis phases

### AICPA SOC 2 Trust Services Criteria
- Privacy criteria can serve as a baseline for gap analysis
- Particularly useful for US market entry assessments

## Gap Analysis Methodology Standards

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- Provides principles for competent auditing applicable to gap analysis
- Audit programme management; evidence-based approach; risk-based approach

### ISACA COBIT 2019
- Control objectives framework that includes privacy-relevant controls
- Gap analysis methodology: assess capability levels (0-5) against target levels

## Country-Specific Resources for Market Entry

### Vietnam — Decree 13/2023/ND-CP
- Personal Data Protection Decree effective 1 July 2023
- Administered by Ministry of Public Security
- Transfer impact assessment dossier requirement for cross-border transfers

### Indonesia — Law No. 27 of 2022 (PDP Law)
- Personal Data Protection Law effective 17 October 2024
- Administered by designated government institution (under establishment)
- Consent as primary basis; cross-border transfer with adequate protection requirement

### Philippines — Data Privacy Act of 2012 (RA 10173)
- Enforced by the National Privacy Commission (NPC)
- Registration of personal information filing systems
- Mandatory DPO appointment

### Saudi Arabia — Personal Data Protection Law (PDPL)
- Enacted September 2021, amended 2023, effective September 2023 (transitional period)
- Saudi Data and Artificial Intelligence Authority (SDAIA) oversight
- Data localisation requirements for certain categories

## Common Gap Patterns in Market Entry

| Gap Pattern | Frequency | Typical Jurisdictions | Remediation Complexity |
|------------|-----------|----------------------|----------------------|
| Privacy notice language/localisation | Very common | All new jurisdictions | Low — translation and legal review |
| Cross-border transfer mechanism | Common | China, Brazil, Vietnam, Indonesia | High — regulatory filings required |
| Local representative appointment | Common | EU, China, India, Vietnam | Medium — identify and appoint local representative |
| DPO/privacy officer appointment | Common | EU, Brazil, Thailand, Korea | Medium — recruit or designate local DPO |
| Consent mechanism adaptation | Common | China, Korea, India | Medium — consent UI changes |
| Data localisation compliance | Occasional | China (CIIO), India (payments), Saudi Arabia | High — infrastructure changes |
| Sector-specific registration | Occasional | Philippines, various | Medium — regulatory filing |