Compliance for self-hosted infrastructure

Binds — Service organisations whose customers demand assurance — driven by procurement, not statute.

Demands — Evidence that named controls operated over a period. On a self-hosted platform that means access changes, workload mutations and audit events are produced by the system rather than assembled by hand.

Binds — Organisations seeking certification of an information security management system.

Demands — A defined scope boundary and a Statement of Applicability that maps every Annex A control to a mechanism you operate — with no controls inherited from a provider you cannot audit.

Binds — Controllers and processors established in the Union, and — under Article 3(2) — those outside it who offer goods or services to people in the Union or monitor their behaviour. Scope turns on establishment or targeting, not on a data subject's location alone.

Demands — Article 32 technical measures an auditor can verify, Article 30 records of processing, and Article 33 breach notification by the controller (subject to the unlikely-to-result-in-a-risk exception).

Binds — Financial entities and the ICT third parties they depend on.

Demands — Identification of critical or important functions, resilience testing against them, Article 30 contractual provisions for the ICT services supporting those functions, and a reporting cascade measured in hours.

Binds — Essential and important entities across a widened set of sectors.

Demands — Risk management measures, supply-chain security, and the Article 23(4) reporting cascade.

Binds — Providers and deployers of AI systems, with obligations scaled to risk classification.

Demands — For high-risk systems: logging, traceability, human oversight and data governance that survive an inspection — which is difficult when inference runs on someone else's tenancy.

Binds — Manufacturers of products with digital elements — which reaches further into build pipelines than most teams expect.

Demands — Vulnerability handling, a documented SBOM, and Article 14 reporting of actively exploited vulnerabilities.

Binds — Data Fiduciaries — those deciding the purpose and means — processing digital personal data in India, and processing outside India where it relates to offering goods or services in India. A Data Processor is a distinct role with different duties.

Demands — Consent machinery, data-principal rights including erasure, and a breach notice — architecture decisions, not a policy document.

Binds — Service providers, intermediaries, data centres and body corporates operating in India.

Demands — The tightest clock in this table measured from becoming aware — six hours — plus 180 days of ICT logs retained within Indian jurisdiction and clock synchronisation to NIC/NPL.

Binds — Providers hosting Indian government workloads.

Demands — Eligibility for public-sector procurement rather than a cyber-incident statute: hosting constraints on where and how the platform runs. The residency architecture behind them is covered on /sovereignty, not restated here.

Binds — Covered entities and business associates handling protected health information.

Demands — Safeguards over PHI and a business associate agreement — the gap that opens when inference is sent to a provider who will not sign one.

Binds — Transfers of EU personal data to a third country that cannot rely on an adequacy decision — the SCC and BCR paths, where a transfer impact assessment is required. Adequacy-covered transfers do not carry this burden.

Demands — A transfer impact assessment that survives contact with foreign surveillance law, plus supplementary measures where it does not. The residency architecture this implies is covered on /sovereignty.