General Data Protection Regulation (GDPR)
Principles and data protection obligations in the European Union.
Law and standards
Sources and references
Legal instruments, technical standards, institutions and primary documentation. These sources help distinguish an explanation from the original authority.
Core resources
From concept to primary source
Laws have different scopes and application dates. Technical standards also change between editions; consult the current document and check its scope.
Legal instruments
Spain’s Organic Law 3/2018 (LOPDGDD)
Spanish law complementing the GDPR and regulating digital rights.
NIS2 Directive
Governance and security duties for sectors and entities; always check national transposition.
Digital Operational Resilience Act (DORA)
Digital operational resilience in the financial sector.
Cyber Resilience Act (CRA)
Security and vulnerability management for products with digital elements.
EU Artificial Intelligence Act
Duties vary by system, actor and applicable implementation timetable.
Spanish National Security Framework (ENS)
Security framework for Spanish public-sector systems and affected third parties.
EU e-Evidence Regulation
European production and preservation orders for electronic evidence.
Budapest Convention
International cooperation and legal framework for cybercrime.
Technical frameworks
NIST Cybersecurity Framework
Framework for cybersecurity governance and functions.
NIST SP 800-207 · Zero Trust Architecture
Principles for reducing implicit trust in networks and applications.
NIST AI Risk Management Framework
Guidance for governing risks in AI systems.
ISO/IEC 27001 and management systems
International reference for information security management.
OWASP
Open resources on application security and development.
OWASP · Security of LLM-enabled applications
Risks specific to applications integrating generative models.
NIST Digital Identity Guidelines
Recommendations on digital identity and authentication.
NIST Computer Forensics
Guidance on integrating forensic techniques into incident response.
Institutions
Cloud Security Alliance
References on control, responsibility and risk in cloud services.
Spanish Data Protection Authority (AEPD)
Public guidance on privacy, rights and the security of data processing.
ENISA
EU cybersecurity agency, threat analysis and guidance.
From sources to analysis
Further reading
The library links to primary sources. For their practical application, explore the Knowledge chapters or research records.