Audit Regulations Library
Source documents for GDPR (incl. RoPA, Art. 30), DORA, ISO/IEC 27001 and Customer Data Platform & privacy governance. Retrieved 2026-10-28. EU law PDFs are the official Official Journal versions from the EU Publications Office (the same files EUR-Lex serves).
GDPR & Records of Processing (RoPA)
| Document | What it is | Status | Official source |
|---|---|---|---|
| GDPR_2016-679.pdf | Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016 | In forceNot amended. Art. 30 = RoPA | EUR-Lex |
DORA – Digital Operational Resilience Act
| Document | What it is | Status | Official source |
|---|---|---|---|
| DORA_2022-2554.pdf | Regulation (EU) 2022/2554 (DORA) | In forceApplies from 17 Jan 2025 | EUR-Lex |
| DORA_RTS_2024-1774_ICT_risk_mgmt.pdf | Delegated Reg. (EU) 2024/1774, RTS on the ICT risk-management framework | In force | EUR-Lex |
| DORA_ITS_2024-2956_register_of_information.pdf | Implementing Reg. (EU) 2024/2956, ITS on the register of information (ICT third-party contracts) | In force | EUR-Lex |
| DORA_RTS_2025-301_incident_reporting_content.pdf | Delegated Reg. (EU) 2025/301, content and timelines of major ICT incident reports | In force | EUR-Lex |
| DORA_ITS_2025-302_incident_reporting_templates.pdf | Implementing Reg. (EU) 2025/302, incident reporting templates | In force | EUR-Lex |
Pending changes
Not law as of 2026-10-28.
- Digital Omnibus, procedure 2025/0360(COD), amends GDPR. The Council mandate was agreed 21 Oct 2026. The European Parliament has not adopted its position, and trilogues have not started. Legislative Observatory tracker
- DORA: no amending act has been adopted. Industry is pushing a “DORA 2.0” review (AFME, July 2026).
- Other DORA RTS/ITS (TLPT, subcontracting, oversight, etc.) are listed under “Related documents” for 2022/2554 on EUR-Lex.
Watch list
Not stored here and no obligations; check periodically.
| Item | Why it might matter | Trigger | Official source |
|---|---|---|---|
| Omnibus IV proposal, COM(2025) 501 | Would widen the Art. 30(5) RoPA exemption to <750 employees | ProposalFetch the final text if adopted | European Commission |
| EDPB RoPA template | EDPB report of 11 Feb 2026 commits to publishing one | Not yet publishedFetch the template once published | EDPB |
| ESAs’ DORA incident-reporting operational instructions (16 Sep 2026) | Practical filing guidance | GuidanceFor the team that submits incident reports | ESMA |
| Irish DPC RoPA guidance (Apr 2023) | Practical RoPA example; Irish regulator, not German | Optional | Irish DPC |
ISO/IEC 27001
The 2022 base standard is paid and not hosted here.
| Document | What it is | Status | Official source |
|---|---|---|---|
| ISO/IEC 27001:2022 | Information security management systems – Requirements | Current editionPaid; not hosted | iso.org |
| ISO_IEC_27001_2022_Amd_1_2024(en).pdf | ISO/IEC 27001:2022/Amd 1:2024, climate action changes | CurrentCHF 0 from ISO (account needed) | iso.org |
Customer Data Platform & Privacy Governance
Marketing & IT. The core law is GDPR (GDPR_2016-679.pdf above).
| Document | What it is | Version / status | Official source |
|---|---|---|---|
| EU_ePrivacy_Directive_2002-58_consolidated_2009.pdf | ePrivacy Directive: cookies, tracking, e-mail/SMS marketing (Art. 5(3), 13) | In forceConsolidated 19.12.2009 | EUR-Lex |
| DE_TDDDG_Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz.pdf | German TDDDG (formerly TTDSG); §25 consent for cookies and tracking | In forceCurrent text | gesetze-im-internet.de |
| EDPB_05-2020_Consent_v1.1.pdf | Guidelines 05/2020 on consent | Finalv1.1 | EDPB |
| EDPB_02-2023_ePrivacy_Art5-3_tracking_v2.pdf | Guidelines 2/2023, technical scope of Art. 5(3) ePrivacy (pixels, tracking links, IoT, unique IDs) | Finalv2.0 (7 Oct 2024) | EDPB |
| EDPB_01-2024_Legitimate_interest_v1_consultation.pdf | Guidelines 1/2024 on legitimate interest, Art. 6(1)(f) (incl. direct marketing) | Consultation draftv1.0; no final version yet | EDPB |
| EDPB_08-2020_Targeting_social_media_users_v2.pdf | Guidelines 8/2020 on targeting social media users (custom audiences, joint controllership) | Finalv2.0 | EDPB |
| EDPB_07-2020_Controller_processor_v2.1.pdf | Guidelines 07/2020, controller/processor (CDP vendor roles, DPAs) | Finalv2.1 | EDPB |
| EDPB_04-2019_Data_protection_by_design_v2.pdf | Guidelines 4/2019, Art. 25 data protection by design and by default | Finalv2.0 | EDPB |
| EDPB_03-2022_Deceptive_design_patterns_v2.pdf | Guidelines 03/2022 on deceptive design patterns (consent UX) | Finalv2.0 | EDPB |
| EDPB_01-2025_Pseudonymisation_v1_consultation.pdf | Guidelines 01/2025 on pseudonymisation (hashed IDs in CDP/identity resolution) | Consultation draftv1.0; no final version yet | EDPB |
| EDPB_02-2026_Anonymisation_v1_consultation.pdf | Guidelines 02/2026 on anonymisation | Consultationv1.0; closes 30 Oct 2026 | EDPB |
| EDPB_03-2025_DSA-GDPR_interplay_v2_final.pdf | Guidelines 3/2025 on DSA–GDPR interplay (online ads, profiling) | Finalv2.0 (17 Sep 2026) | EDPB |
- Pending: the Digital Omnibus (2025/0360(COD)) would move cookie consent rules into GDPR and change breach deadlines. It is not law yet (see Pending changes).
- The Council mandate keeps cookie rules in the ePrivacy Directive (IAPP, Oct 2026).