Data residency requirements by country: which of 21 jurisdictions localise customer data or restrict transfers, with regulators, sources and check dates.
Updated
Map customer data architecture to the rules and operational evidence your organisation needs to assess. This collection covers privacy, transfers, resilience, security and AI governance across jurisdictions. Begin with the regulation relevant to your industry, then trace its implications for consent, storage, access, suppliers and exit plans. The DORA guide connects service contracts to the register of information. Country guides connect residency questions to primary sources. Use the deadline tracker to identify items for review, keeping proposals distinct from rules in force. Dates and confidence labels describe the research snapshot rather than a legal opinion. Requirements depend on your role, sector, contracts and processing activities. Confirm the current position with qualified counsel before making a deployment or compliance decision.
Explore this collection
regulation
Which marketing SaaS tools belong in the DORA register of information, how to classify them, the Article 30 clauses your CDP and ESP contracts need.
Updated
DPDP Act compliance checklist: the 13 Nov 2026 consent manager date, the 13 May 2027 deadline, notice, consent, breach, children, penalties and marketing data.
Updated
EU AI Act compliance checklist for marketing and customer decisioning: post-Omnibus deadlines, high-risk vs transparency rules, Article 50 and 20 actions.
Updated
EU cloud sovereignty framework explained: the four CADA assurance levels, who must use them, EUCS and SecNumCloud, and where to host customer data.
Updated
EU Data Act cloud switching explained: 2-month notice, 30-day transition, switching charges ending 12 Jan 2027, and an exit checklist for SaaS contracts.
Updated
EU-US Data Privacy Framework status: Latombe appeal C-703/25 P, what a Schrems III ruling would change, and a transfer plan for US-hosted marketing SaaS.
Updated
Is Google Analytics GDPR compliant in 2026? The 2022 rulings, what the EU-US Data Privacy Framework changed, cookie fines, compliant setups and alternatives.
Updated
HIPAA marketing rules explained: the 164.501 definition, when written authorization is required, the exceptions, sale of PHI, and how to enforce them.
Updated
HIPAA Security Rule update 2026 tracker: NPRM status, what is proposed (MFA, encryption, 72-hour restoration), objections, timeline and a readiness checklist.
Updated
Is Mailchimp HIPAA compliant? Vendor-by-vendor BAA answers for HubSpot, Klaviyo, GA4, Salesforce, Braze, Segment and more, from vendors' own pages.
Updated
NIS2 compliance checklist for customer data and martech systems: scope, the ten Article 21 measures, 24-hour incident reporting and 2026 transposition status.
Updated
PCI DSS marketing data rules for v4.0.1: what card data must never enter a CRM or customer data platform, tokenisation, scope reduction, payment-page scripts.
Updated
Regulatory deadlines 2027 for data privacy, AI and resilience: dated tracker from Oct 2026 to Dec 2028 with sources, actions and status for every row.
Updated
How the Saudi PDPL applies to customer data: consent, direct-marketing opt-out, SDAIA transfer safeguards, sector rules and fines, plus a PDPL vs GDPR table.
Updated
UAE PDPL status and the executive-regulations gap, DIFC and ADGM rules, health data localisation, bank data rules and marketing consent, with a checklist.
Updated
Data Use and Access Act 2025 marketing changes: what commenced 5 February 2026, cookie exemptions, PECR fines up to £17.5 million, automated decisions.
Updated
State privacy laws 2026: effective dates through 2028, thresholds, universal opt-out (GPC), sensitive data, profiling opt-outs and cure periods for 23 states.
Updated
Further reading
Published: · Updated:
Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.