Knowledge Hub
Privacy organisations & guidance
Authoritative organisations producing privacy, data protection, security and AI governance guidance — the bodies whose output shapes practice. Curated to the essentials, with links to official sources.
| Body | What it produces | Source |
|---|---|---|
| EDPB | European Data Protection Board — GDPR guidelines, recommendations and opinions. | edpb.europa.eu |
| EDPS | European Data Protection Supervisor — opinions and EU institution guidance. | edps.europa.eu |
| ENISA | EU Agency for Cybersecurity — security & privacy engineering guidance. | enisa.europa.eu |
| OECD | Privacy Guidelines and cross-border data flow principles. | oecd.org |
| Council of Europe | Convention 108 / 108+ — the international data protection treaty. | coe.int |
| ICO | UK regulator guidance — accountability, AI, transfers, DSARs and more. | ico.org.uk |
| CNIL | French DPA — influential methodologies (e.g. DPIA, AI). | cnil.fr |
| OAIC (Australia) | Office of the Australian Information Commissioner — independent statutory agency under the Australian Information Commissioner Act 2010, regulating the Privacy Act 1988, FOI and the Consumer Data Right. Publishes privacy guidance for organisations and agencies, including on notifiable data breaches, facial recognition, AI products and generative AI, and privacy impact assessments. Detail page → | oaic.gov.au |
| PCPD (Hong Kong) | Office of the Privacy Commissioner for Personal Data — independent statutory body under the Personal Data (Privacy) Ordinance (Cap. 486). Publishes guidance notes and codes of practice in parallel English and Chinese, including on data security, cloud, CCTV and drones, cross-border model clauses, generative AI and an AI personal-data framework. Detail page → | pcpd.org.hk |
| PDPC (Singapore) | Personal Data Protection Commission — administers the Personal Data Protection Act 2012 and publishes an English-language estate of advisory guidelines and practical guides (DPIA, data protection management programmes, AI in decision systems, anonymisation) and the Do Not Call Registry. Detail page → | pdpc.gov.sg |
| Body | What it produces | Source |
|---|---|---|
| ISO | International standards (27001, 27701, 42001, 31000…). | iso.org |
| NIST | US frameworks — Privacy Framework, CSF, AI RMF, SP 800-series. | nist.gov |
| CSA | Cloud Security Alliance — CCM, STAR, cloud guidance. | cloudsecurityalliance.org |
| BSI | British Standards Institution — BS 10012 and UK adoptions. | bsigroup.com |
| Body | What it produces | Source |
|---|---|---|
| IAPP | International Association of Privacy Professionals — certification, research, resources. | iapp.org |
| CIPL | Centre for Information Policy Leadership — policy thought leadership. | informationpolicycentre.com |
| FPF | Future of Privacy Forum — research on emerging privacy issues. | fpf.org |
| ISACA | Governance, audit and assurance guidance (COBIT, certifications). | isaca.org |
| ISF | Information Security Forum — Standard of Good Practice. | securityforum.org |
Sponsor slot
Align your organisation with an authoritative privacy resource. Sponsorship enquiries.
Curated to the essentials and growing. Run a privacy or GRC organisation? Add your organisation — listing is free and follows our published inclusion criteria, never payment.