UK GDPR and DPA 2018: Core data protection legislation in the UK that governs how personal data must be handled, processed, and protected in security assessments
PECR: Privacy and Electronic Communications Regulations governing electronic communications security and privacy requirements
ISO 27001: International standard for information security management systems, providing framework for security assessments
NIS Regulations 2018: Network and Information Systems Regulations focusing on critical infrastructure and essential services security
Public Contracts Regulations 2015: Legislation governing public sector procurement processes including security assessment requirements
Computer Misuse Act 1990: Criminal law addressing unauthorized access to computer systems and related cybersecurity offenses
Employment Rights Act 1996: Legislation relevant to security vetting requirements and employee screening processes
Equality Act 2010: Law ensuring non-discrimination in security vetting and assessment processes
NCSC Guidelines: National Cyber Security Centre's official guidance and best practices for security assessments
Cyber Essentials: UK government-backed certification scheme defining basic security controls organizations should have
Industry-Specific Regulations: Sector-specific requirements such as FCA regulations for financial services or NHS Digital Standards for healthcare
Cross-border Requirements: International data transfer and security requirements for organizations operating across borders
