Compliance · Overview

Compliance guides, in plain words.

The security and AI rules that matter in India, the Gulf and Europe, explained without legal jargon: who they apply to, the dates, the penalties and what to do first. Every guide is checked against the official text.

Ask which rules apply to you Find the rules that apply
9 guides, checked November 2026India, UAE, Saudi Arabia, EUReadiness, testing and evidence
In plain words

Compliance means proving you follow the rules that apply to you. For most of our clients that is a mix of laws (India’s DPDP Act and CERT-In directions, the UAE and Saudi data laws, the EU AI Act), sector rules (RBI, SEBI, IRDAI and SAMA) and standards customers ask for (ISO 27001, ISO 42001 and SOC 2). These guides explain each one in plain words. We get you ready and provide testing evidence; licensed auditors and certification bodies issue the reports and certificates.

Guides
9 laws and standards
Regions
India · UAE · Saudi · EU · Global
Last checked
2 November 2026
Our role
Readiness, testing, evidence
By region

The rules, region by region.

Pick your market. Each guide covers who the rule applies to, the key dates, the penalties and what to do first.

India

UAE

Saudi Arabia

Europe

Global standards

Emblems are HanulSec’s own artwork, not the official logos of these laws, standards or regulators.

Which rules apply to you?

Start from what you do.

Most companies answer to three or four of these at once. Find each line that is true for you; the guide on the right is where to start.

Which compliance guides apply to you. If you handle personal data of people in India: the DPDP Act. If you run IT systems or online services in India: CERT-In. If you are a bank, NBFC, broker, fund or insurer: RBI, SEBI and IRDAI rules. If customers ask how you keep their data safe: ISO 27001. If US customers ask for an audit report: SOC 2. If customers or regulators ask how you govern AI: ISO 42001. If your AI is sold or used in the EU: the EU AI Act. If you handle personal data in the UAE: the UAE PDPL. If you serve Saudi government or infrastructure: the Saudi NCA ECC. You handle personal data of people in India DPDP ACTIndia’s data protection law→You run IT systems or online services in India CERT-IN6-hour reports, audits→You are a bank, NBFC, broker, fund or insurer RBI · SEBI · IRDAIFinance sector cyber rules→Customers ask how you keep their data safe ISO 27001Security certificate→US customers ask for an audit report SOC 2Trust Services report→Customers or regulators ask how you govern AI ISO 42001AI management certificate→Your AI is sold in the EU, or used there EU AI ACTEurope’s AI law→You handle personal data in the UAE UAE PDPLUAE data and cyber rules→You serve Saudi government or infrastructure SAUDI NCA ECCSaudi cyber and data rules→
  1. You handle personal data of people in IndiaDPDP ActIndia’s data protection law →
  2. You run IT systems or online services in IndiaCERT-In6-hour reports, audits →
  3. You are a bank, NBFC, broker, fund or insurerRBI, SEBI, IRDAIFinance sector cyber rules →
  4. Customers ask how you keep their data safeISO 27001Security certificate →
  5. US customers ask for an audit reportSOC 2Trust Services report →
  6. Customers or regulators ask how you govern AIISO 42001AI management certificate →
  7. Your AI is sold in the EU, or used thereEU AI ActEurope’s AI law →
  8. You handle personal data in the UAEUAE PDPLUAE data and cyber rules →
  9. You serve Saudi government or infrastructureSaudi NCA ECCSaudi cyber and data rules →
Coming up

What is due in the next two years.

NOV 2026DPDP consent managersDEC 2026EU AI labelling grace endsMAY 2027DPDP main duties applyDEC 2027EU high-risk AI rulesAUG 2028EU AI in regulated products TODAY · NOV 2026
  1. NOV 2026DPDP consent managers
  2. DEC 2026EU AI labelling grace ends
  3. MAY 2027DPDP main duties apply
  4. DEC 2027EU high-risk AI rules
  5. AUG 2028EU AI in regulated products

Also in play: RBI’s cyber directions of 31 July 2026 apply already, and Saudi Arabia consulted on tighter data rules in October 2026.

How we help

One programme, many rulebooks.

  • One gap check

    Your controls scored against every rule that applies, with one combined fix list.

  • Testing as evidence

    Penetration tests and AI red teaming mapped to the controls auditors check.

  • Policies that fit

    Written for how your business really works, not copied from a template.

  • Incident drills

    One playbook for CERT-In, the DPDP Board and your sector regulator.

  • Audit-day support

    We sit beside you while auditors ask their questions.

  • Honest about our role

    We are not a CERT-In empanelled auditor and we do not issue certificates. We get you ready.

Questions

Compliance questions, answered.

Q01Which rules apply to my company?
Usually three or four at once. Most Indian companies answer to the DPDP Act and CERT-In; banks, NBFCs, brokers and insurers add their regulator’s rules; and customers often ask for ISO 27001 or SOC 2. If your AI reaches Europe, the EU AI Act may apply too. A free 30-minute call with us is enough to map it.
Q02Are you a CERT-In empanelled auditor?
No. We prepare you for audits, test your systems, including AI, and help fix findings. Where a rule requires a CERT-In empanelled auditor, the formal audit is done by one.
Q03Do you issue ISO certificates or SOC 2 reports?
No. ISO certificates come from accredited certification bodies, and SOC 2 reports from licensed CPA firms. Keeping preparation separate from certification is what makes the certificate trustworthy.
Q04Can one project cover several rules?
Yes, and it should. DPDP, CERT-In, ISO 27001, ISO 42001 and SOC 2 overlap heavily. We build one set of controls and evidence, then map it to each rule you answer to.
Q05Do Indian rules apply to foreign companies?
Some do. The DPDP Act covers processing outside India when it is connected to offering goods or services to people in India. Similarly, the EU AI Act and the UAE and Saudi data laws reach Indian companies that serve those markets.
Q06How current are these guides?
Each guide shows the date it was last checked against the official text. Rules change often, so we update the guides when they do, and we flag draft changes that are still under consultation.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings