What this page covers
Cybersecurity laws, regulations and codes increasingly shape how organisations are expected to manage cyber risk.
For each one, we show:
✓ What the law or standard is about
✓ Who it applies to
✓ What your main obligations are
✓ What happens if you don’t comply
✓ How ARMD.digital can support compliance
Please note: These summaries reflect ARMD.digital’s interpretation, are for information only, and do not constitute legal advice.
Types of Regulation
Regulatory instruments work in different ways. Some define outcomes, others set specific requirements, while codes provide governance and leadership guidance.
Here’s how they differ:
Principle-Based Laws
These set broad goals or outcomes (e.g. “protect personal data”) and give organisations the flexibility to decide how to meet them.
Rules-Based Laws
These are prescriptive. They set out specific steps, controls, and procedures you must follow.
Codes
Codes are best-practice frameworks for governance, leadership, and risk management.