IT Regulatory Compliance in the UK

By Alan Calder

This pocket guide provides you with a concise and accessible guide to the relevant UK legislation, including the Data Protection Act 1998, the Freedom of Information Act 2000 and the Regulation of Investigatory Powers Act 2000. It explains the importance of keeping and preserving records, and outlines the type of records your organisation is obliged to retain. IT compliance represents a key challenge for information professionals.

• Language: English
• Publisher: itgovernance
• Release date: May 1, 2007
• ISBN: 9781849281676

Alan Calder

Alan Calder is a leading author on IT governance and information security issues. He is the CEO of GRC International Group plc, the AIM-listed company that owns IT Governance Ltd. Alan is an acknowledged international cyber security guru. He has been involved in the development of a wide range of information security management training courses that have been accredited by the International Board for IT Governance Qualifications (IBITGQ). He is a frequent media commentator on information security and IT governance issues, and has contributed articles and expert comment to a wide range of trade, national and online news outlets.

Book preview

Resources

CHAPTER 1: INTRODUCTION

A key challenge for all IT management teams is to ensure that the organization avoids breaches of any criminal or civil law, as well as any statutory, regulatory or contractual obligations, and of any security requirements.

Control A.15.1.1 of ISO/IEC 27001:2005 provides guidance that is relevant to the IT governance of every organization. It says that the organization should explicitly define and document the statutory, regulatory and contractual requirements for each of its information systems, and that this documentation should be kept up-to-date to reflect any relevant changes in the legal environment.

The specific controls and individual responsibilities to meet these requirements should be similarly documented and kept up-to-date, and should be linked to the list of all the data assets and processes in the organization, together with their ownership details.

Foreign legislation may also be applicable to the operations of the organization; in particular, legislation passed in America (such as the Digital Millennium Copyright Act and others, discussed below) may affect the international operations of UK-based organizations or may be the basis on which a US-based organization takes action against a UK-based one. Again, expert legal advice is necessary and the rapid, ongoing development of the law should be tracked on a regular basis.

This Pocket Guide provides initial guidance to all who are concerned with IT regulatory compliance in the UK. There is a separate title that provides guidance on North American IT regulatory compliance.

The outline of relevant legislation in this Pocket Guide is not intended to be authoritative. Current legal advice must be taken from qualified, specialist legal advisers if an organization wants or needs to rely on any matter discussed here. Equally, it should be noted that this Pocket Guide deals with current compliance issues for organizations based or operating in or supplying the UK market: laws are likely to be different in other countries and, therefore, organizations based elsewhere should take specialist local