If you keep or process personal information, you are probably subject to privacy regulations

​

GDPR and other privacy regulations around the world mandate your obligations when it comes to collecting and handling personal information, personal rights, full disclosure and beyond. It’s about data-flow rather than processes and systems.

​

The key idea behind most privacy laws is separation of powers, mainly between the CISO and the DPO.