🇦🇫No local entry
Afghanistan
Asia · Southern Asia · M49 004
No area-specific entry yetGlobal regulation directoryRegulations by country.
Regulations by country.
Research you can inspect.
Browse regulatory source candidates and provision leads by country or area. The map shows research status. Separate limited Great Britain, Australia and Canada policy wording checks are available.
162 source candidates38 provision leads32 mapped origins0 independently reviewed international packs
Latest source study · October 19, 20261 more places.
1 more places.
1 new document leads.
We added provision-level source leads for the places shown here. They still need version, applicability and independent legal review. No international report check is available from these leads.
Browse all 38 research leadsAlso reviewed: 0 narrow source questions
These findings concern only the named provisions. They do not describe a whole country’s obligations.
What AuditReady checks today
US draft policy checks are available for a free report.
These 4 draft packs assess document wording against US source text. They have not had independent compliance or legal review. A report is a readiness aid, not a compliance decision.
See all assessment details →Country research status
See the full country directory ↓32 mapped places have source candidates or provision leads.
The directory covers 248 UN M49 countries and areas. 216 have neither type of area-specific entry yet. EU and other cross-border labels stay separate; a source origin does not establish where a rule applies.
Australia9 source candidates · 3 provision leadsBrazil3 source candidates · 1 provision leadCanada13 source candidates · 1 provision leadChile0 source candidates · 1 provision leadChina1 source candidate · 1 provision leadChina, Hong Kong Special Administrative Region1 source candidate · 0 provision leadsColombia0 source candidates · 1 provision leadDenmark0 source candidates · 1 provision leadGermany0 source candidates · 1 provision leadIndia6 source candidates · 0 provision leadsIndonesia0 source candidates · 2 provision leadsIreland0 source candidates · 2 provision leadsJapan2 source candidates · 0 provision leadsKenya0 source candidates · 1 provision leadMalaysia0 source candidates · 1 provision leadMauritius0 source candidates · 1 provision leadMexico1 source candidate · 1 provision leadNew Zealand0 source candidates · 2 provision leadsNigeria0 source candidates · 2 provision leadsNorway0 source candidates · 1 provision leadPeru0 source candidates · 1 provision leadPhilippines0 source candidates · 2 provision leadsRepublic of Korea0 source candidates · 1 provision leadRwanda0 source candidates · 1 provision leadSaudi Arabia1 source candidate · 1 provision leadSingapore5 source candidates · 1 provision leadSouth Africa1 source candidate · 1 provision leadSwitzerland0 source candidates · 1 provision leadTrinidad and Tobago0 source candidates · 1 provision leadUnited Arab Emirates3 source candidates · 0 provision leadsUnited Kingdom of Great Britain and Northern Ireland17 source candidates · 2 provision leadsUnited States of America75 source candidates · 0 provision leads
Cross-border catalog labels: Global · United States / Global · European Union. These are research labels, not automatic country coverage.
The global atlas
See where each source begins.
Choose a rule to spotlight its recorded origin. Explore every country or area by flag below. A source location does not establish where the rule applies to your business.
248countries & areas32research origins0reviewed global packs
REGULATORY SOURCE MAP
Explore the world, one source at a time.
Research originNo mapped origin
Map outlines are for navigation only. Some small islands and territories appear in the directory but not at this map scale.
Full country and area directory
Every place in the research tracker.
All 248 entries are listed below. Flags identify the UN M49 area; status describes only this catalog.
Showing all 248 matching areas. EU and global entries are not assigned to individual areas automatically.
🇦🇱No local entry
Albania
Europe · Southern Europe · M49 008
No area-specific entry yet🇩🇿No local entry
Algeria
Africa · Northern Africa · M49 012
No area-specific entry yet🇦🇸No local entry
American Samoa
Oceania · Polynesia · M49 016
No area-specific entry yet🇦🇩No local entry
Andorra
Europe · Southern Europe · M49 020
No area-specific entry yet🇦🇴No local entry
Angola
Africa · Sub-Saharan Africa · M49 024
No area-specific entry yet🇦🇮No local entry
Anguilla
Americas · Latin America and the Caribbean · M49 660
No area-specific entry yet🇦🇶No local entry
Antarctica
Unassigned · M49 010
No area-specific entry yet🇦🇬No local entry
Antigua and Barbuda
Americas · Latin America and the Caribbean · M49 028
No area-specific entry yet🇦🇷No local entry
Argentina
Americas · Latin America and the Caribbean · M49 032
No area-specific entry yet🇦🇲No local entry
Armenia
Asia · Western Asia · M49 051
No area-specific entry yet🇦🇼No local entry
Aruba
Americas · Latin America and the Caribbean · M49 533
No area-specific entry yet🇦🇺Research entry
Australia
Oceania · Australia and New Zealand · M49 036
9 source candidates ↗3 provision leads ↗🇦🇹No local entry
Austria
Europe · Western Europe · M49 040
No area-specific entry yet🇦🇿No local entry
Azerbaijan
Asia · Western Asia · M49 031
No area-specific entry yet🇧🇸No local entry
Bahamas
Americas · Latin America and the Caribbean · M49 044
No area-specific entry yet🇧🇭No local entry
Bahrain
Asia · Western Asia · M49 048
No area-specific entry yet🇧🇩No local entry
Bangladesh
Asia · Southern Asia · M49 050
No area-specific entry yet🇧🇧No local entry
Barbados
Americas · Latin America and the Caribbean · M49 052
No area-specific entry yet🇧🇾No local entry
Belarus
Europe · Eastern Europe · M49 112
No area-specific entry yet🇧🇪No local entry
Belgium
Europe · Western Europe · M49 056
No area-specific entry yet🇧🇿No local entry
Belize
Americas · Latin America and the Caribbean · M49 084
No area-specific entry yet🇧🇯No local entry
Benin
Africa · Sub-Saharan Africa · M49 204
No area-specific entry yet🇧🇲No local entry
Bermuda
Americas · Northern America · M49 060
No area-specific entry yet🇧🇹No local entry
Bhutan
Asia · Southern Asia · M49 064
No area-specific entry yet🇧🇴No local entry
Bolivia (Plurinational State of)
Americas · Latin America and the Caribbean · M49 068
No area-specific entry yet🇧🇶No local entry
Bonaire, Sint Eustatius and Saba
Americas · Latin America and the Caribbean · M49 535
No area-specific entry yet🇧🇦No local entry
Bosnia and Herzegovina
Europe · Southern Europe · M49 070
No area-specific entry yet🇧🇼No local entry
Botswana
Africa · Sub-Saharan Africa · M49 072
No area-specific entry yet🇧🇻No local entry
Bouvet Island
Americas · Latin America and the Caribbean · M49 074
No area-specific entry yet🇧🇷Research entry
Brazil
Americas · Latin America and the Caribbean · M49 076
3 source candidates ↗1 provision lead ↗🇮🇴No local entry
British Indian Ocean Territory
Africa · Sub-Saharan Africa · M49 086
No area-specific entry yet🇻🇬No local entry
British Virgin Islands
Americas · Latin America and the Caribbean · M49 092
No area-specific entry yet🇧🇳No local entry
Brunei Darussalam
Asia · South-eastern Asia · M49 096
No area-specific entry yet🇧🇬No local entry
Bulgaria
Europe · Eastern Europe · M49 100
No area-specific entry yet🇧🇫No local entry
Burkina Faso
Africa · Sub-Saharan Africa · M49 854
No area-specific entry yet🇧🇮No local entry
Burundi
Africa · Sub-Saharan Africa · M49 108
No area-specific entry yet🇨🇻No local entry
Cabo Verde
Africa · Sub-Saharan Africa · M49 132
No area-specific entry yet🇰🇭No local entry
Cambodia
Asia · South-eastern Asia · M49 116
No area-specific entry yet🇨🇲No local entry
Cameroon
Africa · Sub-Saharan Africa · M49 120
No area-specific entry yet🇨🇦Research entry
Canada
Americas · Northern America · M49 124
13 source candidates ↗1 provision lead ↗🇰🇾No local entry
Cayman Islands
Americas · Latin America and the Caribbean · M49 136
No area-specific entry yet🇨🇫No local entry
Central African Republic
Africa · Sub-Saharan Africa · M49 140
No area-specific entry yet🇹🇩No local entry
Chad
Africa · Sub-Saharan Africa · M49 148
No area-specific entry yet🇨🇱Research entry
Chile
Americas · Latin America and the Caribbean · M49 152
1 provision lead ↗🇨🇳Research entry
China
Asia · Eastern Asia · M49 156
1 source candidate ↗1 provision lead ↗🇭🇰Research entry
China, Hong Kong Special Administrative Region
Asia · Eastern Asia · M49 344
1 source candidate ↗🇲🇴No local entry
China, Macao Special Administrative Region
Asia · Eastern Asia · M49 446
No area-specific entry yet🇨🇽No local entry
Christmas Island
Oceania · Australia and New Zealand · M49 162
No area-specific entry yet🇨🇨No local entry
Cocos (Keeling) Islands
Oceania · Australia and New Zealand · M49 166
No area-specific entry yet🇨🇴Research entry
Colombia
Americas · Latin America and the Caribbean · M49 170
1 provision lead ↗🇰🇲No local entry
Comoros
Africa · Sub-Saharan Africa · M49 174
No area-specific entry yet🇨🇬No local entry
Congo
Africa · Sub-Saharan Africa · M49 178
No area-specific entry yet🇨🇰No local entry
Cook Islands
Oceania · Polynesia · M49 184
No area-specific entry yet🇨🇷No local entry
Costa Rica
Americas · Latin America and the Caribbean · M49 188
No area-specific entry yet🇭🇷No local entry
Croatia
Europe · Southern Europe · M49 191
No area-specific entry yet🇨🇺No local entry
Cuba
Americas · Latin America and the Caribbean · M49 192
No area-specific entry yet🇨🇼No local entry
Curaçao
Americas · Latin America and the Caribbean · M49 531
No area-specific entry yet🇨🇾No local entry
Cyprus
Asia · Western Asia · M49 196
No area-specific entry yet🇨🇿No local entry
Czechia
Europe · Eastern Europe · M49 203
No area-specific entry yet🇨🇮No local entry
Côte d’Ivoire
Africa · Sub-Saharan Africa · M49 384
No area-specific entry yet🇰🇵No local entry
Democratic People's Republic of Korea
Asia · Eastern Asia · M49 408
No area-specific entry yet🇨🇩No local entry
Democratic Republic of the Congo
Africa · Sub-Saharan Africa · M49 180
No area-specific entry yet🇩🇰Research entry
Denmark
Europe · Northern Europe · M49 208
1 provision lead ↗🇩🇯No local entry
Djibouti
Africa · Sub-Saharan Africa · M49 262
No area-specific entry yet🇩🇲No local entry
Dominica
Americas · Latin America and the Caribbean · M49 212
No area-specific entry yet🇩🇴No local entry
Dominican Republic
Americas · Latin America and the Caribbean · M49 214
No area-specific entry yet🇪🇨No local entry
Ecuador
Americas · Latin America and the Caribbean · M49 218
No area-specific entry yet🇪🇬No local entry
Egypt
Africa · Northern Africa · M49 818
No area-specific entry yet🇸🇻No local entry
El Salvador
Americas · Latin America and the Caribbean · M49 222
No area-specific entry yet🇬🇶No local entry
Equatorial Guinea
Africa · Sub-Saharan Africa · M49 226
No area-specific entry yet🇪🇷No local entry
Eritrea
Africa · Sub-Saharan Africa · M49 232
No area-specific entry yet🇪🇪No local entry
Estonia
Europe · Northern Europe · M49 233
No area-specific entry yet🇸🇿No local entry
Eswatini
Africa · Sub-Saharan Africa · M49 748
No area-specific entry yet🇪🇹No local entry
Ethiopia
Africa · Sub-Saharan Africa · M49 231
No area-specific entry yet🇫🇰No local entry
Falkland Islands (Malvinas)
Americas · Latin America and the Caribbean · M49 238
No area-specific entry yet🇫🇴No local entry
Faroe Islands
Europe · Northern Europe · M49 234
No area-specific entry yet🇫🇯No local entry
Fiji
Oceania · Melanesia · M49 242
No area-specific entry yet🇫🇮No local entry
Finland
Europe · Northern Europe · M49 246
No area-specific entry yet🇫🇷No local entry
France
Europe · Western Europe · M49 250
No area-specific entry yet🇬🇫No local entry
French Guiana
Americas · Latin America and the Caribbean · M49 254
No area-specific entry yet🇵🇫No local entry
French Polynesia
Oceania · Polynesia · M49 258
No area-specific entry yet🇹🇫No local entry
French Southern Territories
Africa · Sub-Saharan Africa · M49 260
No area-specific entry yet🇬🇦No local entry
Gabon
Africa · Sub-Saharan Africa · M49 266
No area-specific entry yet🇬🇲No local entry
Gambia
Africa · Sub-Saharan Africa · M49 270
No area-specific entry yet🇬🇪No local entry
Georgia
Asia · Western Asia · M49 268
No area-specific entry yet🇩🇪Research entry
Germany
Europe · Western Europe · M49 276
1 provision lead ↗🇬🇭No local entry
Ghana
Africa · Sub-Saharan Africa · M49 288
No area-specific entry yet🇬🇮No local entry
Gibraltar
Europe · Southern Europe · M49 292
No area-specific entry yet🇬🇷No local entry
Greece
Europe · Southern Europe · M49 300
No area-specific entry yet🇬🇱No local entry
Greenland
Americas · Northern America · M49 304
No area-specific entry yet🇬🇩No local entry
Grenada
Americas · Latin America and the Caribbean · M49 308
No area-specific entry yet🇬🇵No local entry
Guadeloupe
Americas · Latin America and the Caribbean · M49 312
No area-specific entry yet🇬🇺No local entry
Guam
Oceania · Micronesia · M49 316
No area-specific entry yet🇬🇹No local entry
Guatemala
Americas · Latin America and the Caribbean · M49 320
No area-specific entry yet🇬🇬No local entry
Guernsey
Europe · Northern Europe · M49 831
No area-specific entry yet🇬🇳No local entry
Guinea
Africa · Sub-Saharan Africa · M49 324
No area-specific entry yet🇬🇼No local entry
Guinea-Bissau
Africa · Sub-Saharan Africa · M49 624
No area-specific entry yet🇬🇾No local entry
Guyana
Americas · Latin America and the Caribbean · M49 328
No area-specific entry yet🇭🇹No local entry
Haiti
Americas · Latin America and the Caribbean · M49 332
No area-specific entry yet🇭🇲No local entry
Heard Island and McDonald Islands
Oceania · Australia and New Zealand · M49 334
No area-specific entry yet🇻🇦No local entry
Holy See
Europe · Southern Europe · M49 336
No area-specific entry yet🇭🇳No local entry
Honduras
Americas · Latin America and the Caribbean · M49 340
No area-specific entry yet🇭🇺No local entry
Hungary
Europe · Eastern Europe · M49 348
No area-specific entry yet🇮🇸No local entry
Iceland
Europe · Northern Europe · M49 352
No area-specific entry yet🇮🇳Research entry
India
Asia · Southern Asia · M49 356
6 source candidates ↗🇮🇩Research entry
Indonesia
Asia · South-eastern Asia · M49 360
2 provision leads ↗🇮🇷No local entry
Iran (Islamic Republic of)
Asia · Southern Asia · M49 364
No area-specific entry yet🇮🇶No local entry
Iraq
Asia · Western Asia · M49 368
No area-specific entry yet🇮🇪Research entry
Ireland
Europe · Northern Europe · M49 372
2 provision leads ↗🇮🇲No local entry
Isle of Man
Europe · Northern Europe · M49 833
No area-specific entry yet🇮🇱No local entry
Israel
Asia · Western Asia · M49 376
No area-specific entry yet🇮🇹No local entry
Italy
Europe · Southern Europe · M49 380
No area-specific entry yet🇯🇲No local entry
Jamaica
Americas · Latin America and the Caribbean · M49 388
No area-specific entry yet🇯🇵Research entry
Japan
Asia · Eastern Asia · M49 392
2 source candidates ↗🇯🇪No local entry
Jersey
Europe · Northern Europe · M49 832
No area-specific entry yet🇯🇴No local entry
Jordan
Asia · Western Asia · M49 400
No area-specific entry yet🇰🇿No local entry
Kazakhstan
Asia · Central Asia · M49 398
No area-specific entry yet🇰🇪Research entry
Kenya
Africa · Sub-Saharan Africa · M49 404
1 provision lead ↗🇰🇮No local entry
Kiribati
Oceania · Micronesia · M49 296
No area-specific entry yet🇰🇼No local entry
Kuwait
Asia · Western Asia · M49 414
No area-specific entry yet🇰🇬No local entry
Kyrgyzstan
Asia · Central Asia · M49 417
No area-specific entry yet🇱🇦No local entry
Lao People's Democratic Republic
Asia · South-eastern Asia · M49 418
No area-specific entry yet🇱🇻No local entry
Latvia
Europe · Northern Europe · M49 428
No area-specific entry yet🇱🇧No local entry
Lebanon
Asia · Western Asia · M49 422
No area-specific entry yet🇱🇸No local entry
Lesotho
Africa · Sub-Saharan Africa · M49 426
No area-specific entry yet🇱🇷No local entry
Liberia
Africa · Sub-Saharan Africa · M49 430
No area-specific entry yet🇱🇾No local entry
Libya
Africa · Northern Africa · M49 434
No area-specific entry yet🇱🇮No local entry
Liechtenstein
Europe · Western Europe · M49 438
No area-specific entry yet🇱🇹No local entry
Lithuania
Europe · Northern Europe · M49 440
No area-specific entry yet🇱🇺No local entry
Luxembourg
Europe · Western Europe · M49 442
No area-specific entry yet🇲🇬No local entry
Madagascar
Africa · Sub-Saharan Africa · M49 450
No area-specific entry yet🇲🇼No local entry
Malawi
Africa · Sub-Saharan Africa · M49 454
No area-specific entry yet🇲🇾Research entry
Malaysia
Asia · South-eastern Asia · M49 458
1 provision lead ↗🇲🇻No local entry
Maldives
Asia · Southern Asia · M49 462
No area-specific entry yet🇲🇱No local entry
Mali
Africa · Sub-Saharan Africa · M49 466
No area-specific entry yet🇲🇹No local entry
Malta
Europe · Southern Europe · M49 470
No area-specific entry yet🇲🇭No local entry
Marshall Islands
Oceania · Micronesia · M49 584
No area-specific entry yet🇲🇶No local entry
Martinique
Americas · Latin America and the Caribbean · M49 474
No area-specific entry yet🇲🇷No local entry
Mauritania
Africa · Sub-Saharan Africa · M49 478
No area-specific entry yet🇲🇺Research entry
Mauritius
Africa · Sub-Saharan Africa · M49 480
1 provision lead ↗🇾🇹No local entry
Mayotte
Africa · Sub-Saharan Africa · M49 175
No area-specific entry yet🇲🇽Research entry
Mexico
Americas · Latin America and the Caribbean · M49 484
1 source candidate ↗1 provision lead ↗🇫🇲No local entry
Micronesia (Federated States of)
Oceania · Micronesia · M49 583
No area-specific entry yet🇲🇨No local entry
Monaco
Europe · Western Europe · M49 492
No area-specific entry yet🇲🇳No local entry
Mongolia
Asia · Eastern Asia · M49 496
No area-specific entry yet🇲🇪No local entry
Montenegro
Europe · Southern Europe · M49 499
No area-specific entry yet🇲🇸No local entry
Montserrat
Americas · Latin America and the Caribbean · M49 500
No area-specific entry yet🇲🇦No local entry
Morocco
Africa · Northern Africa · M49 504
No area-specific entry yet🇲🇿No local entry
Mozambique
Africa · Sub-Saharan Africa · M49 508
No area-specific entry yet🇲🇲No local entry
Myanmar
Asia · South-eastern Asia · M49 104
No area-specific entry yet🇳🇦No local entry
Namibia
Africa · Sub-Saharan Africa · M49 516
No area-specific entry yet🇳🇷No local entry
Naoero
Oceania · Micronesia · M49 520
No area-specific entry yet🇳🇵No local entry
Nepal
Asia · Southern Asia · M49 524
No area-specific entry yet🇳🇱No local entry
Netherlands (Kingdom of the)
Europe · Western Europe · M49 528
No area-specific entry yet🇳🇨No local entry
New Caledonia
Oceania · Melanesia · M49 540
No area-specific entry yet🇳🇿Research entry
New Zealand
Oceania · Australia and New Zealand · M49 554
2 provision leads ↗🇳🇮No local entry
Nicaragua
Americas · Latin America and the Caribbean · M49 558
No area-specific entry yet🇳🇪No local entry
Niger
Africa · Sub-Saharan Africa · M49 562
No area-specific entry yet🇳🇬Research entry
Nigeria
Africa · Sub-Saharan Africa · M49 566
2 provision leads ↗🇳🇺No local entry
Niue
Oceania · Polynesia · M49 570
No area-specific entry yet🇳🇫No local entry
Norfolk Island
Oceania · Australia and New Zealand · M49 574
No area-specific entry yet🇲🇰No local entry
North Macedonia
Europe · Southern Europe · M49 807
No area-specific entry yet🇲🇵No local entry
Northern Mariana Islands
Oceania · Micronesia · M49 580
No area-specific entry yet🇳🇴Research entry
Norway
Europe · Northern Europe · M49 578
1 provision lead ↗🇴🇲No local entry
Oman
Asia · Western Asia · M49 512
No area-specific entry yet🇵🇰No local entry
Pakistan
Asia · Southern Asia · M49 586
No area-specific entry yet🇵🇼No local entry
Palau
Oceania · Micronesia · M49 585
No area-specific entry yet🇵🇦No local entry
Panama
Americas · Latin America and the Caribbean · M49 591
No area-specific entry yet🇵🇬No local entry
Papua New Guinea
Oceania · Melanesia · M49 598
No area-specific entry yet🇵🇾No local entry
Paraguay
Americas · Latin America and the Caribbean · M49 600
No area-specific entry yet🇵🇪Research entry
Peru
Americas · Latin America and the Caribbean · M49 604
1 provision lead ↗🇵🇭Research entry
Philippines
Asia · South-eastern Asia · M49 608
2 provision leads ↗🇵🇳No local entry
Pitcairn
Oceania · Polynesia · M49 612
No area-specific entry yet🇵🇱No local entry
Poland
Europe · Eastern Europe · M49 616
No area-specific entry yet🇵🇹No local entry
Portugal
Europe · Southern Europe · M49 620
No area-specific entry yet🇵🇷No local entry
Puerto Rico
Americas · Latin America and the Caribbean · M49 630
No area-specific entry yet🇶🇦No local entry
Qatar
Asia · Western Asia · M49 634
No area-specific entry yet🇰🇷Research entry
Republic of Korea
Asia · Eastern Asia · M49 410
1 provision lead ↗🇲🇩No local entry
Republic of Moldova
Europe · Eastern Europe · M49 498
No area-specific entry yet🇷🇴No local entry
Romania
Europe · Eastern Europe · M49 642
No area-specific entry yet🇷🇺No local entry
Russian Federation
Europe · Eastern Europe · M49 643
No area-specific entry yet🇷🇼Research entry
Rwanda
Africa · Sub-Saharan Africa · M49 646
1 provision lead ↗🇷🇪No local entry
Réunion
Africa · Sub-Saharan Africa · M49 638
No area-specific entry yet🇧🇱No local entry
Saint Barthélemy
Americas · Latin America and the Caribbean · M49 652
No area-specific entry yet🇸🇭No local entry
Saint Helena
Africa · Sub-Saharan Africa · M49 654
No area-specific entry yet🇰🇳No local entry
Saint Kitts and Nevis
Americas · Latin America and the Caribbean · M49 659
No area-specific entry yet🇱🇨No local entry
Saint Lucia
Americas · Latin America and the Caribbean · M49 662
No area-specific entry yet🇲🇫No local entry
Saint Martin (French Part)
Americas · Latin America and the Caribbean · M49 663
No area-specific entry yet🇵🇲No local entry
Saint Pierre and Miquelon
Americas · Northern America · M49 666
No area-specific entry yet🇻🇨No local entry
Saint Vincent and the Grenadines
Americas · Latin America and the Caribbean · M49 670
No area-specific entry yet🇼🇸No local entry
Samoa
Oceania · Polynesia · M49 882
No area-specific entry yet🇸🇲No local entry
San Marino
Europe · Southern Europe · M49 674
No area-specific entry yet🇸🇹No local entry
Sao Tome and Principe
Africa · Sub-Saharan Africa · M49 678
No area-specific entry yet🇸🇦Research entry
Saudi Arabia
Asia · Western Asia · M49 682
1 source candidate ↗1 provision lead ↗🇸🇳No local entry
Senegal
Africa · Sub-Saharan Africa · M49 686
No area-specific entry yet🇷🇸No local entry
Serbia
Europe · Southern Europe · M49 688
No area-specific entry yet🇸🇨No local entry
Seychelles
Africa · Sub-Saharan Africa · M49 690
No area-specific entry yet🇸🇱No local entry
Sierra Leone
Africa · Sub-Saharan Africa · M49 694
No area-specific entry yet🇸🇬Research entry
Singapore
Asia · South-eastern Asia · M49 702
5 source candidates ↗1 provision lead ↗🇸🇽No local entry
Sint Maarten (Dutch part)
Americas · Latin America and the Caribbean · M49 534
No area-specific entry yet🇸🇰No local entry
Slovakia
Europe · Eastern Europe · M49 703
No area-specific entry yet🇸🇮No local entry
Slovenia
Europe · Southern Europe · M49 705
No area-specific entry yet🇸🇧No local entry
Solomon Islands
Oceania · Melanesia · M49 090
No area-specific entry yet🇸🇴No local entry
Somalia
Africa · Sub-Saharan Africa · M49 706
No area-specific entry yet🇿🇦Research entry
South Africa
Africa · Sub-Saharan Africa · M49 710
1 source candidate ↗1 provision lead ↗🇬🇸No local entry
South Georgia and the South Sandwich Islands
Americas · Latin America and the Caribbean · M49 239
No area-specific entry yet🇸🇸No local entry
South Sudan
Africa · Sub-Saharan Africa · M49 728
No area-specific entry yet🇪🇸No local entry
Spain
Europe · Southern Europe · M49 724
No area-specific entry yet🇱🇰No local entry
Sri Lanka
Asia · Southern Asia · M49 144
No area-specific entry yet🇵🇸No local entry
State of Palestine
Asia · Western Asia · M49 275
No area-specific entry yet🇸🇩No local entry
Sudan
Africa · Northern Africa · M49 729
No area-specific entry yet🇸🇷No local entry
Suriname
Americas · Latin America and the Caribbean · M49 740
No area-specific entry yet🇸🇯No local entry
Svalbard and Jan Mayen Islands
Europe · Northern Europe · M49 744
No area-specific entry yet🇸🇪No local entry
Sweden
Europe · Northern Europe · M49 752
No area-specific entry yet🇨🇭Research entry
Switzerland
Europe · Western Europe · M49 756
1 provision lead ↗🇸🇾No local entry
Syrian Arab Republic
Asia · Western Asia · M49 760
No area-specific entry yet🇹🇯No local entry
Tajikistan
Asia · Central Asia · M49 762
No area-specific entry yet🇹🇭No local entry
Thailand
Asia · South-eastern Asia · M49 764
No area-specific entry yet🇹🇱No local entry
Timor-Leste
Asia · South-eastern Asia · M49 626
No area-specific entry yet🇹🇬No local entry
Togo
Africa · Sub-Saharan Africa · M49 768
No area-specific entry yet🇹🇰No local entry
Tokelau
Oceania · Polynesia · M49 772
No area-specific entry yet🇹🇴No local entry
Tonga
Oceania · Polynesia · M49 776
No area-specific entry yet🇹🇹Research entry
Trinidad and Tobago
Americas · Latin America and the Caribbean · M49 780
1 provision lead ↗🇹🇳No local entry
Tunisia
Africa · Northern Africa · M49 788
No area-specific entry yet🇹🇲No local entry
Turkmenistan
Asia · Central Asia · M49 795
No area-specific entry yet🇹🇨No local entry
Turks and Caicos Islands
Americas · Latin America and the Caribbean · M49 796
No area-specific entry yet🇹🇻No local entry
Tuvalu
Oceania · Polynesia · M49 798
No area-specific entry yet🇹🇷No local entry
Türkiye
Asia · Western Asia · M49 792
No area-specific entry yet🇺🇬No local entry
Uganda
Africa · Sub-Saharan Africa · M49 800
No area-specific entry yet🇺🇦No local entry
Ukraine
Europe · Eastern Europe · M49 804
No area-specific entry yet🇦🇪Research entry
United Arab Emirates
Asia · Western Asia · M49 784
3 source candidates ↗🇬🇧Research entry
United Kingdom of Great Britain and Northern Ireland
Europe · Northern Europe · M49 826
17 source candidates ↗2 provision leads ↗🇹🇿No local entry
United Republic of Tanzania
Africa · Sub-Saharan Africa · M49 834
No area-specific entry yet🇺🇲No local entry
United States Minor Outlying Islands
Oceania · Micronesia · M49 581
No area-specific entry yet🇻🇮No local entry
United States Virgin Islands
Americas · Latin America and the Caribbean · M49 850
No area-specific entry yet🇺🇸Research entry
United States of America
Americas · Northern America · M49 840
75 source candidates ↗🇺🇾No local entry
Uruguay
Americas · Latin America and the Caribbean · M49 858
No area-specific entry yet🇺🇿No local entry
Uzbekistan
Asia · Central Asia · M49 860
No area-specific entry yet🇻🇺No local entry
Vanuatu
Oceania · Melanesia · M49 548
No area-specific entry yet🇻🇪No local entry
Venezuela (Bolivarian Republic of)
Americas · Latin America and the Caribbean · M49 862
No area-specific entry yet🇻🇳No local entry
Viet Nam
Asia · South-eastern Asia · M49 704
No area-specific entry yet🇼🇫No local entry
Wallis and Futuna Islands
Oceania · Polynesia · M49 876
No area-specific entry yet🇪🇭No local entry
Western Sahara
Africa · Northern Africa · M49 732
No area-specific entry yet🇾🇪No local entry
Yemen
Asia · Western Asia · M49 887
No area-specific entry yet🇿🇲No local entry
Zambia
Africa · Sub-Saharan Africa · M49 894
No area-specific entry yet🇿🇼No local entry
Zimbabwe
Africa · Sub-Saharan Africa · M49 716
No area-specific entry yet🇦🇽No local entry
Åland Islands
Europe · Northern Europe · M49 248
No area-specific entry yetArea names and groupings: UN Statistics Division M49, retrieved 2026-10-17. Map outlines: Natural Earth 1:50m. This index includes territories and areas; it is not a list of sovereign states or a legal coverage claim.
Complete regulation research inventory
162research entriesAll 162 regulatory source candidates.
Browse every catalog entry by origin and publisher. These source candidates are separate from the US draft checks above; none is an approved international assessment.
Showing 162 of 162 research entries from the 2026-09-26 catalog. Source identity means the link was located; it does not verify legal scope or current effect.
FTC Standards for Safeguarding Customer Information (Safeguards Rule)
16 CFR Part 314
Federal Trade Commission
Research only · No assessmentCatalog source ↗
FTC Identity Theft Red Flags Rule
16 CFR Part 681
Federal Trade Commission
Research only · No assessmentCatalog source ↗
FTC Disposal of Consumer Report Information and Records
16 CFR Part 682
Federal Trade Commission
Research only · No assessmentCatalog source ↗
Gramm-Leach-Bliley Act, Title V Subtitle A (privacy & safeguards)
15 USC 6801-6809
US Congress (enforced by FTC, CFPB, banking agencies, SEC)
Research only · No assessmentCatalog source ↗
Privacy of Consumer Financial Information (Regulation P)
12 CFR Part 1016
Consumer Financial Protection Bureau
Research only · No assessmentCatalog source ↗
HIPAA Security Rule
45 CFR Part 164 Subpart C (164.302-164.318)
HHS Office for Civil Rights
Research only · No assessmentCatalog source ↗
HIPAA Privacy Rule
45 CFR Part 164 Subpart E
HHS Office for Civil Rights
Research only · No assessmentCatalog source ↗
HIPAA Breach Notification Rule
45 CFR Part 164 Subpart D
HHS Office for Civil Rights
Research only · No assessmentCatalog source ↗
FTC Health Breach Notification Rule
16 CFR Part 318
Federal Trade Commission
Research only · No assessmentCatalog source ↗
Confidentiality of Substance Use Disorder Patient Records
42 CFR Part 2
HHS SAMHSA / OCR
Research only · No assessmentCatalog source ↗
CMS Conditions of Participation: Hospitals
42 CFR Part 482
Centers for Medicare & Medicaid Services
Research only · No assessmentCatalog source ↗
Clinical Laboratory Improvement Amendments (CLIA) laboratory requirements
42 CFR Part 493
CMS / CDC / FDA
Research only · No assessmentCatalog source ↗
BSA/AML program requirements for banks
31 CFR 1020.210
FinCEN (examined by OCC/FDIC/FRB/NCUA)
Research only · No assessmentCatalog source ↗
BSA general provisions (definitions, CDD rule, recordkeeping)
31 CFR Part 1010 (incl. 1010.230 beneficial ownership)
FinCEN
Research only · No assessmentCatalog source ↗
AML program requirements for money services businesses
31 CFR 1022.210
FinCEN
Research only · No assessmentCatalog source ↗
AML program requirements for casinos and card clubs
31 CFR 1021.210
FinCEN
Research only · No assessmentCatalog source ↗
AML/CFT program and SAR rule for investment advisers
31 CFR Part 1032 (2024 final rule; effective date delayed)
FinCEN
Research only · No assessmentCatalog source ↗
SEC Regulation S-P (privacy, safeguards, incident response, service providers) as amended 2024
17 CFR Part 248 Subpart A
Securities and Exchange Commission
Research only · No assessmentCatalog source ↗
SEC Regulation S-ID (identity theft red flags)
17 CFR Part 248 Subpart C
Securities and Exchange Commission / CFTC
Research only · No assessmentCatalog source ↗
Investment Advisers Act compliance program rule
17 CFR 275.206(4)-7
Securities and Exchange Commission
Research only · No assessmentCatalog source ↗
SEC cybersecurity disclosure (Reg S-K Item 106; Form 8-K Item 1.05)
17 CFR 229.106
Securities and Exchange Commission
Research only · No assessmentCatalog source ↗
SOX internal control over financial reporting (management assessment; disclosure controls)
15 USC 7262; 17 CFR 240.13a-15
SEC / PCAOB
Research only · No assessmentCatalog source ↗
FINRA Rule 3110 Supervision
FINRA Rule 3110
FINRA
Research only · No assessmentCatalog source ↗
FINRA Rule 3310 Anti-Money Laundering Compliance Program
FINRA Rule 3310
FINRA
Research only · No assessmentCatalog source ↗
FINRA Rule 4370 Business Continuity Plans and Emergency Contact Information
FINRA Rule 4370
FINRA
Research only · No assessmentCatalog source ↗
RESPA Regulation X (incl. servicing policies, procedures and requirements)
12 CFR Part 1024 (incl. 1024.38)
Consumer Financial Protection Bureau
Research only · No assessmentCatalog source ↗
FFIEC IT Examination Handbook
FFIEC IT Handbook (booklets)
Federal Financial Institutions Examination Council
Research only · No assessmentCatalog source ↗
FFIEC BSA/AML Examination Manual
FFIEC BSA/AML Manual
FFIEC
Research only · No assessmentCatalog source ↗
Interagency Guidelines Establishing Information Security Standards (FDIC version)
12 CFR Part 364, Appendix B
FDIC (parallel: OCC 12 CFR Part 30 App. B; FRB 12 CFR Part 208 App. D-2)
Research only · No assessmentCatalog source ↗
Computer-Security Incident Notification (banking organizations; OCC version)
12 CFR Part 53 (FRB 12 CFR 225 Subpart N; FDIC 12 CFR 304 Subpart C)
OCC / FRB / FDIC
Research only · No assessmentCatalog source ↗
OFAC A Framework for OFAC Compliance Commitments
OFAC Framework (2019)
Treasury OFAC
Research only · No assessmentCatalog source ↗
FCC Customer Proprietary Network Information (CPNI) rules
47 CFR 64.2001-64.2011 (Part 64 Subpart U)
Federal Communications Commission
Research only · No assessmentCatalog source ↗
FDA Current Good Manufacturing Practice for finished pharmaceuticals
21 CFR Parts 210 and 211
Food and Drug Administration
Research only · No assessmentCatalog source ↗
Quality Management System Regulation (QMSR) for medical devices
21 CFR Part 820 (incorporates ISO 13485:2016 by reference)
Food and Drug Administration
Research only · No assessmentSource or rights review needed
Electronic Records; Electronic Signatures
21 CFR Part 11
Food and Drug Administration
Research only · No assessmentCatalog source ↗
cGMP for dietary supplements
21 CFR Part 111
Food and Drug Administration
Research only · No assessmentCatalog source ↗
FSMA Preventive Controls for Human Food
21 CFR Part 117
Food and Drug Administration
Research only · No assessmentCatalog source ↗
FSIS Hazard Analysis and Critical Control Point (HACCP) Systems
9 CFR Part 417
USDA Food Safety and Inspection Service
Research only · No assessmentCatalog source ↗
OSHA Process Safety Management of Highly Hazardous Chemicals
29 CFR 1910.119
Occupational Safety and Health Administration
Research only · No assessmentCatalog source ↗
EPA Risk Management Program
40 CFR Part 68
Environmental Protection Agency
Research only · No assessmentCatalog source ↗
Oil Pollution Prevention (SPCC)
40 CFR Part 112
Environmental Protection Agency
Research only · No assessmentCatalog source ↗
RCRA hazardous waste generator standards
40 CFR Part 262
Environmental Protection Agency (states authorized)
Research only · No assessmentCatalog source ↗
Chemical Facility Anti-Terrorism Standards (CFATS)
6 CFR Part 27
DHS CISA
Research only · No assessmentCatalog source ↗
NERC Critical Infrastructure Protection (CIP) Reliability Standards
NERC CIP family (FERC-approved; versions vary)
NERC / FERC
Research only · No assessmentCatalog source ↗
PHMSA Pipeline Safety: gas transmission (integrity management, O&M, operator qualification)
49 CFR Part 192
Pipeline and Hazardous Materials Safety Administration
Research only · No assessmentCatalog source ↗
NRC Protection of digital computer and communication systems and networks
10 CFR 73.54
Nuclear Regulatory Commission
Research only · No assessmentCatalog source ↗
America's Water Infrastructure Act s.2013 (risk & resilience assessments; emergency response plans)
42 USC 300i-2
EPA
Research only · No assessmentCatalog source ↗
OSHA Hazard Communication Standard
29 CFR 1910.1200
OSHA
Research only · No assessmentCatalog source ↗
OSHA Control of Hazardous Energy (Lockout/Tagout)
29 CFR 1910.147
OSHA
Research only · No assessmentCatalog source ↗
OSHA Emergency Action Plans
29 CFR 1910.38
OSHA
Research only · No assessmentCatalog source ↗
NPDES permit program (incl. stormwater; SWPPP via permits)
40 CFR Part 122
EPA (most states authorized)
Research only · No assessmentCatalog source ↗
MSHA training and retraining of miners
30 CFR Parts 46 and 48
Mine Safety and Health Administration
Research only · No assessmentCatalog source ↗
FMCSA controlled substances and alcohol use and testing
49 CFR Part 382
Federal Motor Carrier Safety Administration
Research only · No assessmentCatalog source ↗
DOT Procedures for Transportation Workplace Drug and Alcohol Testing Programs
49 CFR Part 40
US Department of Transportation
Research only · No assessmentCatalog source ↗
FAA Safety Management Systems
14 CFR Part 5
Federal Aviation Administration
Research only · No assessmentCatalog source ↗
FAA Certification of Airports
14 CFR Part 139
Federal Aviation Administration
Research only · No assessmentCatalog source ↗
FAA Repair Stations
14 CFR Part 145
Federal Aviation Administration
Research only · No assessmentCatalog source ↗
FRA System Safety Program
49 CFR Part 270
Federal Railroad Administration
Research only · No assessmentCatalog source ↗
MTSA facility security
33 CFR Part 105
US Coast Guard
Research only · No assessmentCatalog source ↗
USCG Cybersecurity in the Marine Transportation System
33 CFR Part 101 Subpart F
US Coast Guard
Research only · No assessmentCatalog source ↗
Family Educational Rights and Privacy Act regulations
34 CFR Part 99
US Department of Education
Research only · No assessmentCatalog source ↗
Children's Online Privacy Protection Rule (as amended 2025)
16 CFR Part 312
Federal Trade Commission
Research only · No assessmentCatalog source ↗
DFARS Safeguarding Covered Defense Information and Cyber Incident Reporting
48 CFR 252.204-7012
Department of Defense
Research only · No assessmentCatalog source ↗
NIST SP 800-171 Rev. 3 Protecting CUI in Nonfederal Systems
NIST SP 800-171r3
NIST
Research only · No assessmentCatalog source ↗
Cybersecurity Maturity Model Certification (CMMC) Program
32 CFR Part 170; DFARS 252.204-7021
Department of Defense
Research only · No assessmentCatalog source ↗
FedRAMP (Federal Risk and Authorization Management Program)
FedRAMP Authorization Act (44 USC 3607-3616); OMB M-24-15
GSA FedRAMP PMO
Research only · No assessmentCatalog source ↗
International Traffic in Arms Regulations (ITAR)
22 CFR Parts 120-130
State Department DDTC
Research only · No assessmentCatalog source ↗
Export Administration Regulations (EAR)
15 CFR Parts 730-774
Commerce BIS
Research only · No assessmentCatalog source ↗
NIST Cybersecurity Framework 2.0
NIST CSWP 29
NIST
Research only · No assessmentCatalog source ↗
IRS Publication 4557 Safeguarding Taxpayer Data
IRS Pub. 4557
Internal Revenue Service
Research only · No assessmentCatalog source ↗
IRS Publication 5708 Creating a Written Information Security Plan for your Tax & Accounting Practice
IRS Pub. 5708
Internal Revenue Service / Security Summit
Research only · No assessmentCatalog source ↗
NYDFS Cybersecurity Requirements for Financial Services Companies
23 NYCRR Part 500
New York Department of Financial Services
Research only · No assessmentCatalog source ↗
Standards for the Protection of Personal Information of Residents of the Commonwealth
201 CMR 17.00
Massachusetts Office of Consumer Affairs and Business Regulation
Research only · No assessmentCatalog source ↗
California Consumer Privacy Act as amended by CPRA; CPPA regulations
Cal. Civ. Code 1798.100 et seq.; 11 CCR 7000 et seq.
California Privacy Protection Agency / Attorney General
Research only · No assessmentCatalog source ↗
NAIC Insurance Data Security Model Law (#668)
NAIC Model Law 668
National Association of Insurance Commissioners (enacted by individual states)
Research only · No assessmentCatalog source ↗
PCI Data Security Standard v4.0.1
PCI DSS v4.0.1
PCI Security Standards Council
Research only · No assessmentSource or rights review needed
ISO/IEC 27001:2022 Information security management systems
ISO/IEC 27001:2022
ISO/IEC
Research only · No assessmentSource or rights review needed
ISO 13485:2016 Medical devices - QMS
ISO 13485:2016
ISO
Research only · No assessmentSource or rights review needed
AICPA Trust Services Criteria (SOC 2)
TSP Section 100 (2017 TSC, revised points of focus 2022)
AICPA
Research only · No assessmentSource or rights review needed
FATF Recommendations (International Standards on Combating ML/TF/PF)
FATF 40 Recommendations (updated periodically)
Financial Action Task Force
Research only · No assessmentCatalog source ↗
General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679
European Parliament & Council; national DPAs / EDPB
Research only · No assessmentCatalog source ↗
NIS2 Directive (high common level of cybersecurity)
Directive (EU) 2022/2555
European Parliament & Council; national competent authorities
Research only · No assessmentCatalog source ↗
NIS2 Implementing Regulation - technical & methodological requirements (digital infrastructure, MSPs, cloud, data centres)
Commission Implementing Regulation (EU) 2024/2690
European Commission
Research only · No assessmentCatalog source ↗
Digital Operational Resilience Act (DORA)
Regulation (EU) 2022/2554
European Parliament & Council; ESAs; national competent authorities
Research only · No assessmentCatalog source ↗
DORA RTS on ICT risk management framework
Commission Delegated Regulation (EU) 2024/1774
European Commission (ESAs draft)
Research only · No assessmentCatalog source ↗
Artificial Intelligence Act (as amended by Digital Omnibus on AI)
Regulation (EU) 2024/1689; amended by Regulation (EU) 2026/1744
European Parliament & Council; AI Office; national authorities
Research only · No assessmentCatalog source ↗
Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847
European Parliament & Council; ENISA; market surveillance authorities
Research only · No assessmentCatalog source ↗
Anti-Money Laundering Regulation (AMLR, single rulebook)
Regulation (EU) 2024/1624
European Parliament & Council; AMLA; national FIUs/supervisors
Research only · No assessmentCatalog source ↗
Sixth AML Directive (AMLD6: supervision, FIUs, registers)
Directive (EU) 2024/1640
European Parliament & Council
Research only · No assessmentCatalog source ↗
Regulation establishing the Anti-Money Laundering Authority (AMLA)
Regulation (EU) 2024/1620
European Parliament & Council
Research only · No assessmentCatalog source ↗
Markets in Crypto-Assets Regulation (MiCA)
Regulation (EU) 2023/1114
European Parliament & Council; ESMA/EBA; NCAs
Research only · No assessmentCatalog source ↗
Critical Entities Resilience Directive (CER)
Directive (EU) 2022/2557
European Parliament & Council
Research only · No assessmentCatalog source ↗
Whistleblower Protection Directive
Directive (EU) 2019/1937
European Parliament & Council
Research only · No assessmentCatalog source ↗
Payment Services Directive 2 (PSD2)
Directive (EU) 2015/2366
European Parliament & Council; EBA
Research only · No assessmentCatalog source ↗
Medical Device Regulation (MDR)
Regulation (EU) 2017/745
European Parliament & Council; notified bodies
Research only · No assessmentSource or rights review needed
Regulation on the hygiene of foodstuffs (HACCP principles)
Regulation (EC) No 852/2004
European Parliament & Council
Research only · No assessmentCatalog source ↗
Seveso III Directive (major-accident hazards)
Directive 2012/18/EU
European Parliament & Council
Research only · No assessmentCatalog source ↗
EudraLex Volume 4 - EU GMP Guidelines (incl. Annex 11 computerised systems)
EudraLex Vol. 4
European Commission (DG SANTE) / EMA
Research only · No assessmentCatalog source ↗
Data Act
Regulation (EU) 2023/2854
European Parliament & Council
Research only · No assessmentCatalog source ↗
UK GDPR
Regulation (EU) 2016/679 as it forms part of UK law
Information Commissioner's Office
Research only · No assessmentCatalog source ↗
Data Protection Act 2018
2018 c. 12
UK Parliament; ICO
Research only · No assessmentCatalog source ↗
Data (Use and Access) Act 2025
2025 c. 18
UK Parliament; ICO
Research only · No assessmentCatalog source ↗
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
SI 2017/692
HM Treasury; supervisors (FCA, HMRC, professional bodies)
Research only · No assessmentCatalog source ↗
Proceeds of Crime Act 2002 (Part 7 money laundering)
2002 c. 29
UK Parliament
Research only · No assessmentCatalog source ↗
FCA Handbook SYSC (Senior Management Arrangements, Systems and Controls)
FCA Handbook SYSC
Financial Conduct Authority
Research only · No assessmentCatalog source ↗
FCA Consumer Duty (PRIN 2A)
FCA Handbook PRIN 2A
Financial Conduct Authority
Research only · No assessmentCatalog source ↗
PRA SS1/21 Operational resilience: impact tolerances for important business services
PRA Supervisory Statement SS1/21
Prudential Regulation Authority (Bank of England)
Research only · No assessmentCatalog source ↗
Network and Information Systems Regulations 2018
SI 2018/506
DSIT; sector competent authorities; ICO (RDSPs)
Research only · No assessmentCatalog source ↗
Cyber Security and Resilience (Network and Information Systems) Bill
UK Parliament Bill 4035
UK Parliament / DSIT
Research only · No assessmentCatalog source ↗
Bribery Act 2010 (s.7 failure to prevent bribery)
2010 c. 23
UK Parliament; MoJ guidance
Research only · No assessmentCatalog source ↗
Economic Crime and Corporate Transparency Act 2023 (s.199 failure to prevent fraud)
2023 c. 56
UK Parliament; Home Office guidance
Research only · No assessmentCatalog source ↗
Modern Slavery Act 2015 s.54 (transparency in supply chains)
2015 c. 30 s.54
UK Parliament; Home Office
Research only · No assessmentCatalog source ↗
Health and Safety at Work etc. Act 1974 (s.2(3) written safety policy)
1974 c. 37
UK Parliament; HSE
Research only · No assessmentCatalog source ↗
Control of Major Accident Hazards Regulations 2015 (COMAH)
SI 2015/483
HSE / Environment Agency / SEPA / NRW
Research only · No assessmentCatalog source ↗
Telecommunications (Security) Act 2021 (+ Electronic Communications (Security Measures) Regulations 2022)
2021 c. 31; SI 2022/933
DSIT; Ofcom
Research only · No assessmentCatalog source ↗
Human Medicines Regulations 2012 (GMP via manufacturer licence)
SI 2012/1916
MHRA
Research only · No assessmentCatalog source ↗
Personal Information Protection and Electronic Documents Act (PIPEDA)
S.C. 2000, c. 5
Office of the Privacy Commissioner of Canada
Research only · No assessmentCatalog source ↗
Breach of Security Safeguards Regulations
SOR/2018-64
OPC
Research only · No assessmentCatalog source ↗
Act respecting the protection of personal information in the private sector (as amended by Law 25)
CQLR c P-39.1
Commission d'acces a l'information du Quebec
Research only · No assessmentCatalog source ↗
Proceeds of Crime (Money Laundering) and Terrorist Financing Act
S.C. 2000, c. 17
FINTRAC
Research only · No assessmentCatalog source ↗
Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations
SOR/2002-184
FINTRAC
Research only · No assessmentCatalog source ↗
OSFI Guideline B-13 Technology and Cyber Risk Management
OSFI B-13
Office of the Superintendent of Financial Institutions
Research only · No assessmentCatalog source ↗
OSFI Guideline E-21 Operational Risk Management and Resilience
OSFI E-21
OSFI
Research only · No assessmentCatalog source ↗
OSFI Guideline B-10 Third-Party Risk Management
OSFI B-10
OSFI
Research only · No assessmentCatalog source ↗
Critical Cyber Systems Protection Act (enacted by S.C. 2026, c. 9 / Bill C-8)
S.C. 2026, c. 9 (CCSPA)
Public Safety Canada; sector regulators
Research only · No assessmentCatalog source ↗
Safe Food for Canadians Regulations (preventive control plan)
SOR/2018-108
Canadian Food Inspection Agency
Research only · No assessmentCatalog source ↗
Food and Drug Regulations (Part C Division 2 GMP)
C.R.C., c. 870
Health Canada
Research only · No assessmentCatalog source ↗
Medical Devices Regulations
SOR/98-282
Health Canada
Research only · No assessmentSource or rights review needed
Canada Occupational Health and Safety Regulations
SOR/86-304
Employment and Social Development Canada (Labour Program)
Research only · No assessmentCatalog source ↗
Privacy Act 1988 (Australian Privacy Principles; Notifiable Data Breaches)
Privacy Act 1988 (Cth)
Office of the Australian Information Commissioner
Research only · No assessmentCatalog source ↗
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (as amended 2024; tranche 2)
AML/CTF Act 2006 (Cth)
AUSTRAC
Research only · No assessmentCatalog source ↗
APRA Prudential Standard CPS 234 Information Security
CPS 234
Australian Prudential Regulation Authority
Research only · No assessmentCatalog source ↗
APRA Prudential Standard CPS 230 Operational Risk Management
CPS 230
APRA
Research only · No assessmentCatalog source ↗
Security of Critical Infrastructure Act 2018 (SOCI)
SOCI Act 2018 (Cth)
Department of Home Affairs (CISC)
Research only · No assessmentCatalog source ↗
Cyber Security Act 2024 (ransomware payment reporting; smart device standards)
Cyber Security Act 2024 (Cth)
Department of Home Affairs
Research only · No assessmentCatalog source ↗
Corporations Act 2001 s.912A (AFS licensee general obligations)
Corporations Act 2001 (Cth) s.912A
ASIC
Research only · No assessmentCatalog source ↗
Work Health and Safety Act 2011 (Cth; model law adopted by most states)
WHS Act 2011 (Cth)
Safe Work Australia / Comcare; state regulators
Research only · No assessmentCatalog source ↗
Therapeutic Goods Act 1989
Therapeutic Goods Act 1989 (Cth)
Therapeutic Goods Administration
Research only · No assessmentCatalog source ↗
Personal Data Protection Act 2012
PDPA 2012 (2020 Rev. Ed.)
Personal Data Protection Commission
Research only · No assessmentCatalog source ↗
MAS Technology Risk Management Guidelines
MAS TRM Guidelines (January 2021)
Monetary Authority of Singapore
Research only · No assessmentCatalog source ↗
MAS Notice 626 Prevention of Money Laundering and Countering the Financing of Terrorism - Banks
MAS Notice 626
Monetary Authority of Singapore
Research only · No assessmentCatalog source ↗
MAS Notice FSM-N06 Cyber Hygiene (Notice 655 cancelled; FSM-N06 applies - covered FI types to verify)
MAS Notice FSM-N06
Monetary Authority of Singapore
Research only · No assessmentCatalog source ↗
Cybersecurity Act 2018 (as amended 2024)
Cybersecurity Act 2018
Cyber Security Agency of Singapore
Research only · No assessmentCatalog source ↗
Digital Personal Data Protection Act 2023
Act No. 22 of 2023
MeitY; Data Protection Board of India
Research only · No assessmentCatalog source ↗
Digital Personal Data Protection Rules 2025
Notified 2025-11-13/14 (G.S.R. number to verify)
MeitY
Research only · No assessmentCatalog source ↗
RBI Cyber Security Framework in Banks
RBI/2015-16/418 DBS.CO/CSITE/BC.11/33.01.001/2015-16
Reserve Bank of India
Research only · No assessmentCatalog source ↗
CERT-In Directions under s.70B(6) IT Act (6-hour incident reporting; log retention)
CERT-In Directions No. 20(3)/2022-CERT-In dated 2022-04-28
CERT-In (MeitY)
Research only · No assessmentCatalog source ↗
Prevention of Money-Laundering Act 2002 (+ PML Maintenance of Records Rules 2005)
Act No. 15 of 2003
FIU-IND; sector regulators (RBI, SEBI, IRDAI)
Research only · No assessmentSource or rights review needed
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)
SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 (2024-08-20)
Securities and Exchange Board of India
Research only · No assessmentCatalog source ↗
Act on the Protection of Personal Information (APPI)
Act No. 57 of 2003
Personal Information Protection Commission
Research only · No assessmentCatalog source ↗
Act on Prevention of Transfer of Criminal Proceeds
Act No. 22 of 2007
National Police Agency (JAFIC); FSA
Research only · No assessmentCatalog source ↗
Personal Data (Privacy) Ordinance
Cap. 486
Office of the Privacy Commissioner for Personal Data
Research only · No assessmentCatalog source ↗
Lei Geral de Protecao de Dados Pessoais (LGPD)
Lei n. 13.709/2018
Autoridade Nacional de Protecao de Dados (ANPD)
Research only · No assessmentCatalog source ↗
Anti-money laundering law
Lei n. 9.613/1998
COAF; sector regulators (BCB, CVM, SUSEP)
Research only · No assessmentCatalog source ↗
CMN Resolution 4.893/2021 (cyber security policy and cloud contracting for financial institutions)
Resolucao CMN n. 4.893/2021
Conselho Monetario Nacional / Banco Central do Brasil
Research only · No assessmentCatalog source ↗
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
Federal Decree-Law No. 45/2021
UAE Data Office
Research only · No assessmentCatalog source ↗
Federal Decree-Law No. 10 of 2025 on AML/CFT/CPF
Federal Decree-Law No. 10/2025
UAE FIU; CBUAE; Ministry of Economy (DNFBPs)
Research only · No assessmentCatalog source ↗
DIFC Data Protection Law
DIFC Law No. 5 of 2020
DIFC Commissioner of Data Protection
Research only · No assessmentSource or rights review needed
Personal Information Protection Law (PIPL)
PIPL (adopted 2021-08-20)
Cyberspace Administration of China
Research only · No assessmentCatalog source ↗
Protection of Personal Information Act 4 of 2013 (POPIA)
Act 4 of 2013
Information Regulator (South Africa)
Research only · No assessmentCatalog source ↗
Personal Data Protection Law (PDPL)
Royal Decree M/19 (1443H), as amended
Saudi Data & AI Authority (SDAIA)
Research only · No assessmentCatalog source ↗
Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (2025)
DOF 20-03-2025
Secretaria Anticorrupcion y Buen Gobierno
Research only · No assessmentCatalog source ↗
Provision-level research
38 document leads from official sources.
These narrow source leads identify possible policy, notice, record, statement, internal rule, programme, plan or assessment duties. Their legal scope, source versions and reuse rights have not been independently reviewed. They cannot be used to grade a report.
Australiaprogram
Anti-Money Laundering and Counter-Terrorism Financing Act 2006, sections 26F and 26N; AML/CTF Rules 2025, section 5-15
Section 26N calls for documentation of a reporting entity's AML/CTF program; section 26F describes its policies, and rule 5-15 addresses timing and updates.
Open research questions
- Which designated service and reporting-entity class apply?
- What date do the revised obligations commence for this service?
- Which rules, exemptions and transitional provisions govern the documentation?
Australiaprogram
Australia New Zealand Food Standards Code, Standard 3.2.1, clauses 2–5
Standard 3.2.1 sets requirements for a food safety program where the applicable enforcement agency has determined the business is in a priority classification.
Open research questions
- Which State or Territory law gives the Standard force for this business?
- Has the enforcement agency classified this activity as a priority food business?
- Which current Code compilation and sector-specific standard apply?
AustraliaPolicy candidate
Privacy Act 1988, Schedule 1, Australian Privacy Principle 1.3–1.4
APP 1.3 describes an APP privacy policy; APP 1.4 lists content for that policy.
Open research questions
- Which legal entities are APP entities at the report date?
- Which exemptions and territorial rules apply?
- What is the exact current compilation and provision text?
Brazilrecord
Lei Geral de Proteção de Dados Pessoais, Article 37
Article 37 calls for controllers and processors to maintain records of personal-data processing operations, especially where legitimate interest is used.
Open research questions
- Which processing activities and actors fall within the LGPD?
- Do small-entity regulations modify the form or detail?
- Which version and ANPD rules govern at the report date?
CanadaPolicy candidate
PIPEDA, Schedule 1, clause 4.1.4
Clause 4.1.4 addresses policies and practices that give effect to the Schedule 1 principles.
Open research questions
- When does PIPEDA apply instead of or alongside substantially similar provincial law?
- Does the specific text support a written-document check?
- Which exceptions and organization roles apply?
Chileprogram
Decreto 44/2024, artículo 8
Article 8 describes a preventive work program based on the risk matrix and states that it must be in writing and approved by the legal representative.
Open research questions
- Which employers and workers are covered by the regulation?
- What are the operative article 8 and risk-matrix rules at the report date?
- What special requirements apply to the exact activity?
Chinaassessment
Personal Information Protection Law, Articles 55–56
Article 55 identifies processing cases for a prior personal-information protection impact assessment and a processing record. Article 56 describes the assessment and retention of its report and record.
Open research questions
- Does the organization process personal information within the law's territorial and entity scope?
- Which Article 55 activity, if any, occurs?
- Do later binding measures alter the applicable form or retention rule?
Colombiapolicy
Decree 1377 of 2013, Article 13, under Law 1581 of 2012
Article 13 calls for controllers to develop personal-data treatment policies in physical or electronic form, make them known to data subjects and include listed information.
Open research questions
- Which controller and processor roles apply?
- Is Decree 1377 Article 13 operative in this form at the report date?
- What notice and data-subject communication rules add to policy content?
Denmarkplan
Arbejdsmiljøloven § 15 a; workplace assessment (APV) action plan
The Danish Working Environment Authority describes an APV process with a written action plan for workplace problems not immediately resolved.
Open research questions
- Which employment and volunteer exceptions apply?
- What does the 2026 implementing regulation require in the relevant workplace?
- Which findings trigger an action plan and what content is required?
European UnionFramework
DORA, Article 6(1)–(2)
Article 6 describes a documented ICT risk-management framework with strategies, policies and procedures for financial entities.
Open research questions
- Which financial-entity category applies?
- Which proportionality and delegated rules modify the detail?
- What is the exact report-date text and effective period?
European UnionRecord
GDPR, Article 30(1)–(5)
Article 30 describes records of processing activities, including written form and exceptions.
Open research questions
- Is the entity a controller or processor?
- How do the Article 30(5) conditions and exceptions apply?
- What territorial and report-date rules govern this activity?
European UnionPolicy candidate
NIS2 Directive, Article 21(2)(a)
Article 21(2)(a) identifies policies on risk analysis and information-system security among cybersecurity risk-management measures.
Open research questions
- Which member-state implementing law governs the entity?
- Is the entity essential or important under national law?
- Which sector, size, exceptions and dates apply?
Germanyrecord
Arbeitsschutzgesetz § 6(1)
Section 6(1) describes documents showing the hazard-assessment result, chosen safety measures and the result of their review.
Open research questions
- Which employer, workplace, activities and workers are in scope?
- Which sector-specific or state rules add to the documentation?
- What was the operative text on the intended report date?
Indonesiapolicy
Government Regulation No. 50 of 2012, article 5(2), article 6(2), Annex I section 2
For companies meeting article 5(2), the SMK3 guidelines in Annex I require a written, dated and signed occupational safety and health policy.
Open research questions
- Does the workforce count or legally defined high-hazard threshold apply?
- Which current amendments and sector-specific SMK3 rules control?
- What is the authoritative translation, if any, of the controlling Indonesian text?
Indonesiaassessment
Law No. 27 of 2022 on Personal Data Protection, Article 34(1)–(3)
Article 34 addresses a personal-data-protection impact assessment where processing may pose high risk, with examples of high-risk activities.
Open research questions
- Which listed or delegated high-risk circumstance applies?
- What implementing regulation fixes the assessment method and form?
- What is the current authoritative text and commencement position?
Irelandstatement
Children First Act 2015, section 11(1)(b), (3)
Section 11 requires a qualifying provider to prepare a written child safeguarding statement, including a written risk assessment and specified procedures; section 11(1) sets a three-month timeline for new providers.
Open research questions
- Does the specific activity meet the Schedule 1 relevant-service definition or an exception?
- Which commencement and transitional rules apply to the provider?
- What current Tusla guidelines and amendments govern content and review?
Irelandstatement
Safety, Health and Welfare at Work Act 2005, section 20(1), (8)
Section 20(1) requires an employer to prepare a written safety statement based on the section 19 hazard identification and risk assessment, specifying how workplace safety and health will be managed.
Open research questions
- Is the entity an employer and which workplaces and workers are covered?
- Does an applicable code of practice provide the section 20(8) route?
- What current sector-specific regulations and amendments apply?
Kenyaassessment
Data Protection Act, section 31(1)–(4), and Data Protection (General) Regulations 2021, regulations 49–50
Section 31 calls for a data-protection impact assessment before processing likely to pose high risk and specifies its contents; regulations 49–50 identify example triggers and format. It is a conditional assessment, not a generic policy.
Open research questions
- Does the proposed processing meet the statutory and regulatory high-risk tests?
- Which controller or processor role and territorial rules apply?
- Have the Act, regulations or Data Commissioner guidance changed since the dated texts?
Malaysianotice
Personal Data Protection Act 2010, section 7(1)
Section 7(1) calls for written notice to a data subject. This is a notice duty, not by itself an internal privacy-policy duty.
Open research questions
- Which commercial transactions, controllers, locations and statutory exclusions are covered?
- How do the 2024 amendment and 2025 commencement dates change terminology or content?
- What language, delivery and timing requirements apply?
Mauritiusrecord
Data Protection Act 2017, section 33
Section 33 requires a controller or processor to maintain a record of processing operations and lists its contents.
Open research questions
- What amendments or regulations changed section 33?
- Which controller or processor and processing operations are in scope?
- Do section 44 exceptions or territorial rules affect the entity?
Mexiconotice
Federal Law on Protection of Personal Data Held by Private Parties, Articles 14–16, as amended through 14 November 2025
Articles 14–16 address informing data subjects through a privacy notice, its content and presentation routes.
Open research questions
- Is the entity covered by this private-sector law rather than the public-sector regime?
- What notice modality and timing fit the collection route?
- Which current regulations or later amendments modify the content?
New Zealandprogram
Anti-Money Laundering and Countering Financing of Terrorism Act 2009, sections 56–57
Section 57 describes a written AML/CFT programme based on the entity risk assessment and containing adequate policies, procedures and controls.
Open research questions
- Is the entity a reporting entity for the specific activity?
- Which supervisor and exemption or transitional rules apply?
- What is the current section 57 text at the report date?
New Zealandplan
Food Act 2014, Part 2 risk-based food-sector classification and Schedule 1
The Food Act risk-based framework assigns higher-risk food sectors to food control plans; MPI explains plan types and exemptions.
Open research questions
- Which Schedule 1 food sector and actual activity apply?
- Does a national programme, template or exemption govern instead?
- What is the current notice/template version for this activity?
Nigeriapolicy
Nigeria Data Protection Act 2023, section 27(1)–(3)
Section 27(3) places the information described in section 27(1) in a privacy policy in an accessible format.
Open research questions
- Is the organisation the data controller for the collection?
- Which section 27(2) exceptions apply to indirect collection?
- Have later NDPC regulations changed the required detail?
Nigeriaassessment
Nigeria Data Protection Act 2023, section 28(1)–(4)
Section 28 addresses a pre-processing impact assessment for likely high-risk processing and lists its elements.
Open research questions
- Does the processing meet the high-risk condition?
- Which current NDPC directives prescribe form or categories?
- Is prior consultation required after the assessment?
Norwayprogram
Internkontrollforskriften § 5, second and third paragraphs
Section 5 lists written HMS objectives, responsibility allocation, risk mapping and plans, corrective routines and monitoring as documented elements of internal control.
Open research questions
- Which of the regulation’s enabling statutes apply to the business?
- Which sector rules or permits add to these elements?
- How much documentation is necessary for the entity’s risk and size?
Peruinternal_rule
Decreto Supremo 005-2012-TR, artículo 74
Article 74 describes an internal occupational safety and health regulation for employers with 20 or more workers and a minimum structure.
Open research questions
- How are workers counted and which labor regime applies?
- What is the current consolidated article 74 text?
- Which sector-specific safety rules apply?
Philippinespolicy
Data Privacy Act 2012 implementing rules and regulations, section 26(b)
Section 26(b) addresses appropriate data-protection policies, including documentation, regular review, evaluation and updating of privacy and security policies and practices.
Open research questions
- How do nature, scope, context, purpose and risk set what is appropriate?
- Which controller or processor roles and exemptions apply?
- Do later National Privacy Commission issuances alter the documentation detail?
Philippinesrecord
Data Privacy Act 2012 implementing rules and regulations, section 26(c)
Section 26(c) describes records of processing activities and their required descriptive content; a record is distinct from a privacy policy.
Open research questions
- Which processing systems and roles are within scope?
- Which later rules or circulars modify record content?
- What retention and production duties apply?
Republic of Koreapolicy
Personal Information Protection Act, Article 30(1)
Article 30(1) calls for a personal information controller to establish a personal information processing policy and lists matters to include; disclosure requirements require separate review.
Open research questions
- Which entity and processing activities qualify as a personal information controller?
- What territorial and public-institution rules apply?
- Which current decree provisions govern publication and content?
Rwandarecord
Law No. 058/2021, Article 17
Article 17 states that controllers or processors maintain a record of personal-data processing activities and lists required fields.
Open research questions
- What later amendments, directives or exemptions affect Article 17?
- Which legal entity and processing activities are in scope?
- Does the customer document contain the enumerated record fields?
Saudi Arabiapolicy
Personal Data Protection Law, Article 12
Article 12 calls for a controller to use and make available a privacy policy before collecting personal data, with specified content.
Open research questions
- Who qualifies as controller under the current law?
- Which collection, territorial and sector exemptions apply?
- What current Arabic text and implementing rules govern the content?
Singaporepolicy
Personal Data Protection Act 2012, section 12(a), (c)–(d)
Section 12 requires an organisation to develop and implement necessary policies and practices, communicate them to staff and make information available on request. The written form needs separate legal review.
Open research questions
- Which organisations and processing roles are within the Act?
- When does section 12 support a check for a written policy rather than demonstrated practices?
- Which regulator decisions remain relevant under the current text?
South Africarecord
Protection of Personal Information Act 4 of 2013, section 17, read with PAIA sections 14 and 51
Section 17 calls for a responsible party to maintain documentation of its processing operations by reference to PAIA manual provisions.
Open research questions
- Is the entity a responsible party and a public or private body?
- How do PAIA sections 14 and 51 and current exemptions affect the document?
- Which amendments and effective dates control?
Switzerlandrecord
Federal Act on Data Protection, Article 12(1)–(5)
Article 12 describes controller and processor records of processing activities and minimum content, subject to delegated exceptions.
Open research questions
- Does the current ordinance exempt this entity and processing activity?
- Is the entity a controller, processor, federal body or Swiss representative?
- How do territorial reach and cross-border disclosures affect the record?
Trinidad and Tobagoprogram
Financial Obligations Regulations 2010, regulation 7; FIUTT compliance-programme guidance
Regulation 7 specifies policies, procedures and controls for an AML compliance programme; the FIUTT describes that programme as a written document tailored to the supervised entity.
Open research questions
- Is the business a financial institution or listed business under the current Act and regulations?
- Which supervisory authority and sector guidance control?
- How did later amendments change regulation 7 and the written-form duty?
United Kingdompolicy
Health and Safety at Work etc. Act 1974, section 2(3), with prescribed small-employer exception
Section 2(3) describes a written statement of the employer's general health and safety policy, subject to prescribed exceptions; HSE guidance identifies a five-employee threshold for writing it down.
Open research questions
- Which legal exception sets the employee threshold and how is headcount measured?
- Which territory, workplace and employer are within scope?
- What changes to section 2 or its regulations are operative on the report date?
United Kingdompolicy
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 19(1)(a)–(c)
Regulation 19(1) addresses AML policies, controls and procedures and a written record of them, revisions and internal communication steps.
Open research questions
- Is the entity a relevant person under regulation 8 and which regulator supervises it?
- Which services and jurisdictions trigger the rule?
- What amendment and commencement text governs at the report date?
Sources that still need a provision decision
5 narrow screenings remain open, including a deferred Indian notice rule and provisions that do not by themselves establish a written policy. A screening never means that a country has no other obligations.
- New Zealand: Privacy Act 2020, section 201 ↗no document lead in reviewed provision
- Israel: Protection of Privacy Regulations (Data Security) 5777-2017, regulation 4 candidate ↗source version unresolved
- India: Digital Personal Data Protection Rules 2025, rule 3 and rule 1(4) ↗not yet commenced
- China, Hong Kong Special Administrative Region: Personal Data (Privacy) Ordinance, Schedule 1, Data Protection Principle 5 ↗no document lead in reviewed provision
- China: Personal Information Protection Law, Article 17 ↗no document lead in reviewed provision
From source to a usable check
38 document provision leads remain in the research directory. The separate GB/AU/CA checks are limited drafts and none is independently reviewed. Each lead needs source, scope and report review before it can count as reviewed coverage.
Find the official publisher and the right local instrument.
Record the version, language, date, source identity and reuse rights.
Link each written-document claim to its exact operative provision.
Check the entity, activity, location, thresholds and exceptions.
Check positive, missing, negative and exception cases against a draft pack.
Require independent review, publish a frozen version and watch for changes.