Compliance
When the regulator asks, you already have the record.
You are not buying this for the compliance. You are buying it to run the desk. But the desk is where the evidence lives, so a system that captures the work properly answers the assessor as a by-product.
FrexCore categorises work by the obligation behind it, so a subject access request arrives with a statutory clock attached rather than as a ticket called “query”. The register is configured per instance, so a client in Manchester and a client in Port Moresby each see the obligations that apply to them.
The jurisdiction register.
What the standard configuration recognises. Instruments are named rather than summarised as “global privacy law”, because the difference matters to whoever has to answer for it.
| Where | Instrument | What it asks you to produce |
|---|---|---|
| Europe and the United Kingdom | ||
| United Kingdom | UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 | Records of processing, a lawful basis against each activity, and breach decisions reached and documented inside the statutory window. |
| European Union | GDPR, Articles 28 and 33 | Processor agreements with your suppliers, and a breach decision reached inside 72 hours with the reasoning written down. |
| Asia-Pacific | ||
| Australia | Privacy Act 1988, the Australian Privacy Principles and the Notifiable Data Breaches scheme, as amended in 2024 | An assessment of every suspected eligible breach within thirty days, and notification to the OAIC and affected individuals where the threshold is met. |
| Papua New Guinea | Digital Government Act 2022, with the Data Governance and Data Protection Bill 2026 in consultation | No comprehensive act is in force yet. The draft brings lawful basis, retention, breach notification and subject rights, so the register you build now is the one you will be asked for. |
| Africa | ||
| South Africa | POPIA | Records of processing, security safeguards you can demonstrate, and a trail for every request from a data subject. |
| Zimbabwe | Cyber and Data Protection Act | A processing register, an appointed data protection officer, and evidence that a breach was assessed rather than noticed. |
| Kenya | Data Protection Act, 2019 | Impact assessments before high risk processing, and notification to the Commissioner inside the statutory window. |
| Nigeria | Nigeria Data Protection Act, 2023 | A lawful basis recorded against each processing activity, and an auditable response to data subject rights. |
| Botswana | Data Protection Act | Registration, retention limits applied in practice, and transfers assessed before data leaves the country. |
| Certification frameworks | ||
| Standards | ISO 27001 Annex A, PCI DSS | Change control, access reviews, asset ownership and incident records, in the form an assessor will ask for. |
How an obligation becomes work.
A regulation only helps you if it turns into something a person does on a Tuesday. These are the categories the standard configuration ships with, and what each one starts when it is raised.
| Raised as | What the system does with it |
|---|---|
| Subject access request | Opens with the statutory clock attached and the identity check as the first task, so the deadline is measured from the date it reached you rather than the date it reached the right desk. |
| Personal data breach | Containment and assessment separated, with the assessment recorded against the notification criteria. The reasoning behind a decision not to notify is written down, because that is the part a regulator asks about. |
| Erasure or objection | Tracks the request across every system it has to reach, including the suppression that stops a future import quietly reinstating the record. |
| Cross-border transfer | A transfer assessment required before a migration date, with the processor agreement and the hosting location attached as evidence. |
| Impact assessment | Screening first, then the assessment with risks, mitigations and the residual position, and the sign-off conditions recorded against the project. |
| Records of processing | A register entry with categories, lawful basis, retention and recipients, raised when a system goes live rather than when someone notices it is missing. |
| Privileged access review | Recurring scheduled work with the attestation captured, so the review is late by the calendar rather than by discovery. |
What we sign, and what we will not claim.
A vendor who overstates their compliance position costs you more than one who understates it, because you find out during your own audit.
- Data processing agreement
- Signed as part of onboarding on the Enterprise tier, naming the processing, the sub-processors, the retention position and the assistance we owe you on subject requests and breaches.
- What is certified, and what is not
- The hosting facility holds ISO 27001. FrexCore does not hold its own certification, and we say so rather than letting a facility logo imply one.
- Data residency
- Agreed before onboarding and documented. Your instance does not move jurisdiction because our hosting arrangements changed.
- This is tooling, not advice
- FrexCore produces the evidence and tracks the obligations. It does not tell you what the law requires, and the register is a starting configuration your counsel should confirm.
See it with your own data in it.
Forty minutes on your real situation: what you are running now, where work goes missing, and what a migration would involve. The architecture and control summary goes out beforehand, so your security people arrive having read it. If it is not a fit we will say so on the call.
Book a walkthrough- [email protected]
- Call or message
- +61 480 010 143
- Hours
- We answer across African, European and Pacific time zones.