Most organisations do not get to choose. The obligation arrives through a regulator, a contract, or a customer questionnaire. Tick what is true and this shows what follows, separating what the law requires from what a buyer is asking for.
Pick every one that applies. This is usually what forces the decision.
Both carry obligations in the EU that have no direct UK equivalent.
Tick something above and the frameworks that follow will appear here, ordered by how the obligation arises.
This maps the common obligations from a handful of answers. It is a starting point for a conversation, not a legal assessment, and it will not catch sector rules specific to your business. Nothing you tick is stored or sent anywhere.