Compliance frameworks and laws, explained.
Short, plain-English guides to the standards, frameworks and laws that security and compliance teams in India, the Gulf, the US and the EU are asked about. Each one explains what it is, who it applies to and what it asks of an organisation.
Standards, attestations and frameworks
Published by international bodies and used well beyond the country they come from.
ISO 27001
What ISO 27001 certification is, how the audit stages work, how long it takes and how often it renews, and how Purplecop GRC supports the preparation work.
SOC 2
SOC 2 Type I and Type II explained, plus how Purplecop Security's GRC & Compliance Advisory team helps you prepare, from readiness through to your audit.
NIST CSF 2.0
NIST CSF 2.0 explained in plain English: the six Functions, Profiles and Tiers, whether it is mandatory, and how Purplecop Security can help you adopt it.
NIST AI RMF
NIST AI RMF explained: the Govern, Map, Measure and Manage functions, trustworthy AI, its voluntary status, and how Purplecop AIMS maps to the framework.
PCI DSS
PCI DSS explained: who it applies to, the current version, how compliance is validated, and how Purplecop Security supports PCI DSS framework adoption.
Privacy and data protection laws
Laws that set the rules for handling personal and health data.
HIPAA
HIPAA explained: who must comply, what the Privacy, Security and Breach Notification Rules require, and how Purplecop Security's advisory team can help.
GDPR
GDPR explained: who it applies to, rights, the 72-hour breach rule and fines, plus how Purplecop Security's advisory team and Purplecop Privacy fit in.
DPDP Act
India's DPDP Act, 2023 explained: who it covers, when duties start, breach intimation and penalties, and how Purplecop Security and Purplecop Privacy help.
Saudi PDPL
Saudi Arabia's Personal Data Protection Law (PDPL) explained: scope, individual rights, controller duties, data transfers, breach notification and penalties.
Regulator requirements for specific countries and sectors
Controls and directions issued by national and sector regulators.
NCA ECC
NCA's Essential Cybersecurity Controls (ECC-2:2024) explained: who they apply to, what the four domains cover, and how NCA checks compliance in Saudi Arabia.
SAMA Cyber Security Framework
SAMA Cyber Security Framework explained: who it applies to in Saudi Arabia's financial sector, its four domains, maturity levels 0 to 5 and how SAMA reviews it.
IRDAI guidelines
IRDAI's Cyber Security Guidelines explained: the 2023 and 2026 documents, who must follow them, what changed, annual audits and 6-hour incident reporting.
RBI
RBI's 2026 cyber security and IT governance Directions explained: who is covered, six-hour incident reporting, and what happened to the 2016 and 2023 rules.
UAE IA Regulation
The UAE Information Assurance (IA) Regulation, Version 1.1 (March 2020): who must implement it, how its controls are structured and how compliance is measured.
How to read these guides
These guides are general information, not legal advice. Dates, versions and requirements change, so check the current wording with the publisher or regulator before you rely on a page.
Each guide opens with a short answer, then works through the questions people ask most often about that framework or law.
Talk to a practitioner
Tell us the obligation you are trying to meet and who is asking for it. The first call is with a practitioner.