Regulatory monitoring for data protection and information securityIdentify new requirements early, assess them and turn them into your processes.
Laws, regulations, supervisory requirements and audit catalogues change all the time – in the EU and at every one of your sites. Our regulatory monitoring keeps your legal register for data protection and information security up to date: quarterly, per jurisdiction, with clear action items – reviewed and quality-assured by our experts.
Every management system requires it
ISO/IEC 27001 requires you to identify legal, statutory, regulatory and contractual requirements and keep them up to date (control 5.31). TISAX® checks the same with VDA ISA 7.1.1, while ISO/IEC 27701 and the GDPR accountability principle require evidence for data protection. That is why auditors regularly ask for a maintained legal register – and how you handle changes.
From legal register to audit evidence
Build the legal register
We identify the laws, regulations, supervisory requirements and audit catalogues on data protection and information security that apply to your sites.
Quarterly updates
Every quarter we check new and amended requirements and update your legal register – from changes in legislation to new catalogue versions.
Assess relevance
For every change we assess whether and how it affects your company and how urgent the need for action is.
Derive actions
You receive specific recommendations: which policies, processes and controls need to be adapted and by when.
Audit evidence
A documented, versioned legal register with assessment and review log – exactly what auditors want to see.
Personal briefing
On request we discuss the most important changes with you, your data protection officer, your CISO and your management.
One legal register for all your sites
We monitor EU law and the national jurisdictions of your sites. Every change is assigned to the register of the country concerned and assessed – so you see at a glance what needs to be done where.
European Union
Regulations and directives such as GDPR, NIS2, Cyber Resilience Act, DORA and the AI Act
Germany
Federal law, BSI and supervisory requirements, data protection authorities and case law
Switzerland
Federal Act on Data Protection (FADP), Information Security Act, FDPIC guidance
Spain
National data protection law, transposition of EU requirements, supervisory authorities
Poland
National cybersecurity and data protection law, transposition of EU requirements
USA
Federal requirements and the law of the states where you operate, e.g. New York and Michigan
We add further countries, for example France, as needed.
What we monitor for you
Data protection
GDPR, national data protection laws, guidance from supervisory authorities, case law
International data transfers
Adequacy decisions, standard contractual clauses, transfers to the USA
Information security and cyber
NIS2 and national transposition, critical infrastructure, Cyber Resilience Act
Notification duties
Deadlines and channels for security incidents and personal data breaches per country
Industry requirements
TISAX® with VDA ISA, DORA, sector-specific security standards
Standards and catalogues
ISO/IEC 27001, 27002, 27701 and new catalogue versions
Artificial intelligence
AI Act, where data protection and information security are affected
US privacy and cybersecurity
State privacy and breach notification laws, federal agency requirements
We define the scope together with you – matched to your management systems, industries and sites.
Results you can work with and that stand up in the audit
Legal register per jurisdiction
As an Excel file with source, content, relevance, owners and status – versioned every quarter.
Quarterly report
Management summary, the most important changes of the quarter and the specific action items per site.
Assessment by urgency
Every change is rated so you know what needs to be done now and what can wait.
Review log
Documents sources, review and approval – as evidence for audit and management review.
Newsletter for your departments
Short and clear per jurisdiction, ready to forward to departments and management.
Immediate alerts on deadlines
Critical changes with short implementation deadlines are reported additionally as soon as they are assessed.
Four steps to a maintained legal register
Define the scope
Agree on sites, management systems and priorities in data protection and information security.
Create the legal register
Record applicable requirements per jurisdiction and assign them to owners.
Quarterly updates
Check, assess, record and report changes every quarter.
Implement and evidence
Transfer actions into processes and document the status for audit and management review.
Experts with the dual competence of auditors
We know what auditors, IT auditors and external auditors examine. We support the research with AI so that no official gazette and no supervisory notice is missed. Our experts handle assessment, classification and approval – with more than 25 years in information security, data protection and compliance, as auditors for certification bodies and in the standards committees for ISO/IEC 27001 and 27701. Our regulatory monitoring is already in use for companies with sites in Germany, Switzerland, Spain, Poland and the USA.
Note: our regulatory monitoring is not legal advice. For the legal review of individual cases you work with your legal department or law firm; we provide the professional basis for it.
Changes go straight to the affected processes
With ProzessInterview and the coverage evidence, your processes are already mapped to the requirements. When a requirement changes, you immediately see which processes are affected and who is responsible.
- Affected processes and process owners for each change
- Updated coverage matrix for the next audit
- Legal register and actions directly in the CONSUVATION GRC platform
Frequently asked questions
Why do I need regulatory monitoring?
ISO/IEC 27001, TISAX® and ISO/IEC 27701 require you to know the requirements that apply to you and keep them up to date; the GDPR requires you to demonstrate compliance. That is why auditors ask for a maintained legal register and how you handle changes.
Which topics do you cover?
Data protection and information security, including cybersecurity, notification duties, international data transfers and industry requirements such as TISAX® or DORA.
How often will we be informed?
Every quarter you receive the report and the updated legal register. Critical changes with short deadlines are reported additionally as soon as we have assessed them.
Which countries do you cover?
The European Union as well as Germany, Switzerland, Spain, Poland and the USA with the states where you operate. We add further countries such as France as needed.
Is this legal advice?
No. We identify, assess and classify requirements professionally for your management systems. The legal review of individual cases remains with your legal department or law firm; our results are the professional basis for it.
How is the assessment produced?
We support the research with AI so that nothing is missed. Every change is then reviewed, assessed and approved by our experts. The review log documents sources and approval.
Can we start small?
Yes. Many companies start with one topic and their most important sites and then expand. We define the scope together.
What does regulatory monitoring cost?
That depends on jurisdictions, topics and scope. After a short call you receive an offer with a fixed scope of services – no open-ended consulting days.
Which requirements apply to you?
In a short call we clarify your management systems, industries and sites and propose the right scope. You receive an offer with a fixed scope of services.
Peter Rentschler, Managing Director · Phone +49 7031 4181-860 · info@regulatorymonitoring.org