Conscious · agentic assuranceWhitepaper 03 · Privacy operations

One group, many laws

Operating privacy obligations across thirty-four regimes without a services engagement

Most boards can say whether the group is compliant. Few can say whether a single payroll file is allowed to leave the country it sits in. This paper is about the difference between those two sentences, and about what a platform has to model before it can answer the second one.

Audience

Group DPOs, privacy counsel, CISOs of multi-entity groups

Published

October 2026

Edition

First edition, October 2026

Series

The assurance papers

What this paper establishes

• 34 privacy regimes carried as law rather than as a checklist: territorial scope, lawful bases, transfer conditions, subject rights and breach duties, each with the date it was last verified against the instrument.
• The Gulf free zones modelled as the separate regimes they are — DIFC, ADGM and onshore UAE produce three different answers for three entities in one country.
• A transfer verdict per route, computed from the strictest applicable gate, with the condition that produced it named beside it.

consciousgrc.comOctober 2026

Here is a question to put to your own team this week. Group HR consolidates payroll into one warehouse in Riyadh. Six subsidiaries feed it. Which of them is allowed to?

It sounds like one question. It is six, and the answers do not resemble each other. Two of the six are lawful without further work. One is prohibited by default and needs an instrument that does not exist inside the group yet. Three are conditional, and each is conditional on something different: an adequacy finding at the destination, a particular regulator’s own clauses, a consent record that has to be demonstrable per data subject.

Every group of any size has already answered this question. The question is where the answer lives. In most groups it lives in a slide a law firm produced eighteen months ago, in the memory of one privacy manager, and in an email thread no one can find. None of those three survive a regulator asking to see the basis.

The market sells the framework and leaves the law out

The compliance-automation category is built around one buyer: a company in one jurisdiction that needs an audit report. For that buyer the framework is the whole job, and the platforms serve it well. A published review of the five leaders in May 2026 lists the frameworks each one offers. Every one of them offers GDPR. One adds a second privacy law. None of the five carries a Gulf regime at all.

That is not a feature gap that a quarter of engineering closes. It is a modelling decision taken years ago. If the framework is the primary object, a privacy law has to be squeezed in as one more framework: a checklist of articles with a percentage against it. A law is not a checklist. It has territorial scope that decides whether it binds you at all, lawful bases that differ by processing purpose, transfer rules that depend on the destination, rights with their own response deadlines, a registration duty in some countries and not others, and a breach clock that starts on an event rather than on a calendar.

What it means to model the law as the primary object

In Conscious a regime is a first-class record, not a framework in disguise. Each one carries, in the authority’s own structure: its territorial and material scope, its lawful bases, its subject rights with the time allowed to answer each, its transfer conditions, its breach obligations, whether registration or a representative is required, the sanction range, and the open questions the instrument itself leaves unresolved.

The last of those is the one competitors do not carry. An instrument with an unanswered question in it is the normal case rather than the exception, and a platform that hides the question behind a confident number is the reason privacy teams keep a parallel spreadsheet.

A free zone is not a country

The United Arab Emirates is the clearest demonstration of why a regime cannot be modelled as a country. An entity in the Dubai International Financial Centre is subject to the DIFC Data Protection Law and answers to the DIFC Commissioner of Data Protection. An entity in Abu Dhabi Global Market is subject to the ADGM Data Protection Regulations and answers to the ADGM Office of Data Protection. An entity onshore is subject to the federal law. Three regimes, three authorities, three sets of transfer conditions, one country on the map.

A group with one entity in each is a common structure rather than an exotic one, and a platform that routes on the country code will tell all three of them the same thing. Conscious treats the free zones as what they are: separate regimes, selected at the point an entity is created, with the onshore position offered as a distinct third option.

The clock starts when the law says it starts, and sometimes it does not start

Breach notification is where a platform’s honesty is easiest to test. Ask it what the deadline is in Bahrain. A product that prints seventy-two hours for every regime is guessing, and the guess will be discovered during an incident, which is the worst moment available.

Subject rights, at the scale a group receives them

A request arrives in a mailbox, not in a product. Conscious reads a privacy mailbox, raises each message as a request against the right entity and the right regime, and starts that regime’s clock rather than a generic thirty-day timer. Identity verification, the search across the systems named in the processing records, the exemptions applied and the reason for each, the extension where the regime allows one, and the response itself all sit on the same record. A person signs the response; the platform will not send one on its own.

The register answers the two questions an auditor asks about rights: how long the group took, and whether anything was refused without a recorded reason.

Processing records that are a by-product of the work

A record of processing activities decays from the day it is signed off, because it is usually built as a document rather than as a register joined to anything. In Conscious the processing activity is joined to the systems that carry it, the lawful basis under each regime that binds the entity, the transfers it causes, the consent records that support it where consent is the basis, the retention position, and the assessment that cleared it. A new transfer is therefore visible as a change to the record rather than as a question a person remembers to ask.

The same join is what makes a data protection impact assessment start from something. The screening questions are answered against the activity that already exists, and the risks the assessment raises land in the risk register rather than in an appendix.

Currency is a claim, so the platform states its own

Regulatory content is the one part of a GRC platform that is wrong by default. Every pack in Conscious carries the date it was last verified against the instrument and a cadence chosen by how fast that kind of regime moves. The console shows the date, the operational monitor raises an alarm when a pack passes its cadence, and a figure that rests on a lapsed pack says so where the figure is shown.

What this gives counsel

The platform produces a position with its reasons, including the reasons a regime was excluded, for counsel to confirm. That distinction is worth money rather than being a disclaimer: a group that wants an opinion needs a lawyer, and what it has been missing is the instrument-level record that makes the lawyer’s half-day productive instead of archaeological.

The same record is what makes an external review cheap to repeat. The entity map, the regimes that bind each one, the reasoning behind each inclusion and exclusion and the date each pack was verified are all exportable, so the second review starts from the first rather than from the beginning.

How to test any of this in twenty minutes

The claims in this paper are checkable without a call. The assessment on the Conscious site asks where an entity is incorporated, with the DIFC, ADGM and onshore distinction offered as separate answers, whose residents’ data it holds, its sector, and the facts that decide which control frameworks apply. It then shows the obligation map with the reasons, including what was not applied and why, and prints a record you keep.

Run it for the entity you are least sure about. If the output is wrong, the reasons are on the page, which means you can say where it is wrong. That is the only useful kind of vendor claim.