Compliance terms, in plain language.

A risk assessment of processing operations for the rights and freedoms of individuals. Required under Art. 35 GDPR when processing is likely to result in high risk.

The EU General Data Protection Regulation (2016/679). In force since 25 May 2018.

A register of all personal data processing operations carried out by a controller. Required under Art. 30 GDPR.

Regulation 2022/2554 on digital operational resilience for the financial sector. Applicable from 17 January 2025.

EU Directive 2022/2555 on a high common level of cybersecurity across the Union. Transposed in Poland via an amendment to the National Cybersecurity System Act.

Fundamental Rights Impact Assessment: an assessment required by the AI Act for high-risk AI systems.

Business Impact Analysis: an assessment of which processes are critical and how quickly they must be restored after a disruption.

The set of policies, processes, and controls through which an organisation manages information security. The core of ISO 27001.

Standard for a Business Continuity Management System (BCMS). How to keep critical processes running when something goes wrong.

International guidelines for risk management across the entire organisation, not limited to information security.

International standard for an Information Security Management System (ISMS). 2022 edition.

Statement of Applicability: the ISO 27001 document declaring which Annex A controls you apply and why.

A measurable signal with an alert threshold that warns of rising risk before it materialises.

The maximum amount of data that can be lost after a disruption, expressed as a time interval (e.g., the last hour of data).

The maximum time within which a process or system must be restored to operation after a disruption.

The level of risk that remains after controls and safeguards have been implemented.