UK & European compliance
Compliance-first, by design
Serving UK and EU clients means handling their data under some of the world's strictest regimes — including the frameworks most providers have never read past the headline. We build our contracts, controls and processes around them from day one.
From the well-known (GDPR) to the quietly critical (PECR, DUAA, IDTA, NIS2, DORA) — here is the regulatory map we operate against for every UK and European engagement.
United KingdomUK GDPR & Data Protection Act 2018
The UK's core data-protection regime. We act as a documented processor with signed DPAs, access controls and breach-notification procedures for every UK client.
United KingdomPECR 2003
The Privacy and Electronic Communications Regulations — the lesser-known sibling of the GDPR governing electronic communications, cookies and marketing. Our client-facing tooling is configured to respect it.
United KingdomData (Use and Access) Act 2025
The UK's newest data law, updating the UK GDPR and PECR. We track its phased commencement so our UK clients' processing arrangements stay current without them lifting a finger.
United KingdomUK IDTA & UK Addendum
The International Data Transfer Agreement — the ICO's mechanism for lawful UK-to-India data flows. Rarely discussed, absolutely mandatory. It underpins every UK contract we sign.
United KingdomCyber Essentials / CE+
The NCSC-backed baseline UK buyers increasingly demand from suppliers. Our internal controls are built to the Cyber Essentials Plus control set as part of our certification roadmap.
European UnionEU GDPR (2016/679)
Processor obligations under Article 28: documented processing records, sub-processor transparency, security measures and 72-hour breach support for every EU engagement.
European UnionNIS2 Directive (2022/2555)
The EU's expanded cybersecurity directive now catches many mid-size firms and their suppliers. As part of your supply chain, our monitoring and incident-reporting practices are built NIS2-ready.
European UnionDORA (2022/2554)
The Digital Operational Resilience Act for financial-sector clients — including its strict rules on ICT third-party providers like us. Our SLAs, exit plans and incident logs are structured to DORA's register requirements.
European UnionEU Standard Contractual Clauses
The 2021 SCC modules for lawful EU-to-India transfers, paired with transfer impact assessments. Small print most providers skip; we treat it as the foundation of the engagement.
European UnionEU Data Act (2023/2854)
A quietly significant law on data access and cloud-switching rights. Our contracts avoid lock-in terms and support the data-portability obligations it imposes on service providers.
European UnionCyber Resilience Act
The EU's incoming security-by-design regulation for digital products. We track the tooling we deploy in client environments against its emerging conformity requirements.
InternationalISO/IEC 27001:2022
Our information-security management system is modelled on ISO 27001's Annex A controls — the certification benchmark our operations are being built toward.
InternationalISO/IEC 20000-1
The little-cited ITSM standard that actually governs how a helpdesk should run: incident, problem and change management done as a discipline, not an accident.
InternationalISO 22301
Business-continuity management — why we invest in power backup, internet failover and staffed shift redundancy. If we're your night shift, we can never go dark.
InternationalSOC 2 (Trust Services)
Security, availability and confidentiality controls mapped to the SOC 2 framework — the report US and UK mid-market buyers ask for at procurement.
