Converged Security Framework - Data Protection and Privacy Standard

Data Protection and Privacy Standard. Board-approved standard, v2.0. Not a peer-reviewed Journal article. The purpose is demonstrable protection of individuals, lawful cross-domain processing and resilient controls with accountable decisions. Expected benefits are intended outcomes, not guarantees of full compliance, eliminated risk, regulatory recognition or commercial advantage. The adopter shall document entities, purposes, processing activities, personal data, individuals, locations, systems, recipients, suppliers, flows and dependencies. Cyber, physical and OT processing shall be covered where present; an absent domain shall be explained, not invented. Non-personal operational data shall be distinguished from identifiable or inferential personal data. Subsidiaries, joint ventures and partners shall be scoped by actual control, processing roles and lawful arrangements. Access to another entity's systems does not automatically grant control over that entity. Training, platform capability and adopter processing shall be distinguished from GCSB recognition and administration. The adopter shall maintain an applicability register by jurisdiction, entity, sector and activity. UK GDPR, the Data Protection Act 2018 and applicable amendments, EU GDPR and member-state provisions, PECR, NIS2 implementing measures, DORA and relevant other applicable laws are distinct. Law applies by virtue of its own scope, not because an internal framework table marks it as applicable. Binding law takes priority over internal controls; lawful contractual and scheme duties shall be identified separately. Applicable legal duties shall be met from their binding dates, notwithstanding any internal transition, exception or consultation period adopted under this standard. The adopter shall address the 5 February 2026 commencement of UK data-subject rights timing and automated-decision reforms where applicable to it. No EU rule is assumed identical to the corresponding UK rule. Issued by Global Converged Security Board. The adopting organisation is responsible for implementation; publication does not itself confer accreditation or a credential.