Whether you are preparing for GDPR requirements, assessing AI systems under the EU AI Act, managing data subject requests, or responding to a personal data breach, our guides help translate regulatory requirements into actionable steps.
Explore our guides to understand what applies to your organisation, what actions to take, and how to document your compliance efforts.
Explore Our Compliance Guides
GDPR Article 27: EU Representative Guide
Understand when organisations established outside the European Economic Area may need to appoint an EU Representative under GDPR Article 27. Learn about the scope of the requirement, applicable exemptions, the representative's responsibilities, and the steps involved in making an appointment.
What you'll learn:
- When an EU Representative may be required
- Key exemptions and applicability criteria
- The responsibilities of an appointed representative
- Practical considerations for selecting and appointing a representative
EU AI Act Annex III: Identifying High-Risk AI Systems
Learn how to assess whether an AI system may qualify as high-risk under the EU AI Act. This guide explores relevant use cases, classification considerations, and the compliance obligations that may apply to high-risk AI systems.
What you'll learn:
- The high-risk categories listed in Annex III
- How intended purpose and deployment context affect classification
- Key compliance considerations for high-risk AI systems
- Documentation, risk management, and conformity assessment considerations
Cross-Framework DSAR Pipeline: From Intake to Delivery
Build a structured process for receiving, verifying, processing, and responding to Data Subject Access Requests (DSARs). This guide explains how organisations can establish a repeatable workflow while accounting for differences in privacy laws across jurisdictions.
What you'll learn:
- How to receive and track data subject requests
- Proportionate identity verification procedures
- Data discovery, review, and redaction
- Secure response delivery and audit documentation
- How response deadlines and exemptions differ across privacy frameworks
The 72-Hour Breach Response Playbook
Prepare your organisation to assess and respond to personal data breaches through a structured incident response process. Learn how to coordinate internal teams, preserve evidence, assess risks, document decisions, and determine whether regulatory or individual notification is required.
What you'll learn:
- Initial incident assessment and containment
- Personal data breach impact and risk evaluation
- Regulatory notification decision-making
- Data subject communication considerations
- Incident documentation and post-incident review
Important: Notification deadlines and reporting thresholds vary by jurisdiction and incident type. The 72-hour deadline specifically relates to qualifying notifications under GDPR Article 33; it is not a universal deadline for every privacy law.
Transfer Impact Assessment (TIA) After Schrems II
Understand how to assess international personal data transfers under GDPR Chapter V. This guide covers the role of transfer mechanisms, destination-country legal considerations, supplementary measures, and documentation in evaluating cross-border transfer risks.
What you'll learn:
- When a Transfer Impact Assessment may be appropriate
- How standard contractual clauses fit into transfer assessments
- How to evaluate relevant third-country access risks
- Technical, organisational, and contractual supplementary measures
- How to document transfer decisions and reassess changing risks
DPIA Walkthrough: From Threshold Assessment to Sign-Off
Learn how to determine whether a Data Protection Impact Assessment (DPIA) is required and how to conduct one systematically. This guide covers processing descriptions, necessity and proportionality, risk identification, safeguards, and review.
What you'll learn:
- How to screen processing activities for potential high risk
- When GDPR Article 35 may require a DPIA
- How to assess risks to individuals' rights and freedoms
- How to identify and document appropriate safeguards
- When prior consultation with a supervisory authority may be necessary
Turn Regulatory Requirements into Practical Action
Understanding a regulation is only the first step. Organisations also need processes, clear ownership, supporting documentation, and appropriate controls to address their obligations.
RegulatoryBridge's compliance resources help teams:
Understand regulatory requirements
Explore practical explanations of relevant laws, rules, and obligations.
Identify compliance gaps
Recognise areas that may require further assessment or remediation.
Build repeatable workflows
Apply structured approaches to privacy requests, risk assessments, incident response, and governance.
Improve documentation
Understand which decisions, assessments, and records may need to be maintained.
Coordinate across jurisdictions
Identify where local requirements differ and where separate legal assessment may be necessary.
How to Use These Compliance Guides
Identify your compliance question
Start with the guide that matches your immediate need, such as AI risk classification, international data transfers, or breach response.
Review the relevant requirements
Identify the legal provisions, applicability criteria, deadlines, and exemptions relevant to your circumstances.
Assess your current processes
Compare your existing policies, technical controls, responsibilities, and records with the guidance.
Document actions and decisions
Record your assessment, assign responsibilities, and track any required remediation.
Validate jurisdiction-specific obligations
Check current legislation and official regulator guidance before relying on a particular deadline, exemption, or compliance interpretation.
Frequently Asked Questions
What are compliance guides?
Compliance guides explain regulatory requirements and provide practical steps for assessing obligations, implementing controls, maintaining documentation, and managing compliance-related activities.
Who should use these compliance guides?
These resources are intended for compliance officers, privacy professionals, legal teams, information security leaders, risk managers, product teams, and business leaders responsible for regulatory obligations.
Are the guides applicable across all jurisdictions?
Each guide addresses particular regulatory frameworks or cross-framework considerations. Requirements can differ by jurisdiction, organisation type, processing activity, and implementation status. Always verify the rules applicable to your circumstances.
Do these guides replace legal advice?
No. The guides provide general educational and operational guidance. They do not replace legal advice or a fact-specific assessment by a qualified professional.
How often should compliance guidance be reviewed?
Review guidance when relevant laws or regulator instructions change, when your organisation introduces new products or processing activities, and as part of your established compliance review process.
Where can I find more compliance resources?
Explore RegulatoryBridge's regulatory comparisons, assessment tools, jurisdiction information, regulatory updates, and implementation resources for additional guidance.
Need Support With Your Compliance Programme?
RegulatoryBridge helps organisations navigate privacy, AI governance, and regulatory compliance across jurisdictions. Whether you need help understanding an obligation, assessing your compliance position, or establishing a practical implementation plan, our team can help you identify the next steps.
Explore our compliance solutions or contact RegulatoryBridge to discuss your requirements.