CISA CPG Compliance Guide: Actionable Gaps and Realistic Audits
Geert WarmenbolApril 29, 2026
TL;DR
GDPR applies to any organization processing EU resident data regardless of where the organization is headquartered. For APAC companies, this is not theoretical — regulators have fined entities with no EU presence based purely on data flows.
No single APAC jurisdiction maps cleanly to GDPR. Singapore's PDPA, China's PIPL, India's DPDPA, Australia's Privacy Act, and Thailand's PDPA each diverge from GDPR on consent, data localization, cross-border transfer rules, and enforcement timelines — sometimes in ways that directly conflict.
The most expensive compliance failure we see is not choosing the wrong framework. It is assuming that GDPR compliance covers APAC obligations, or vice versa. It covers neither completely.
Vulnox assessments across APAC-headquartered companies processing EU data show that 67% have at least one active GDPR lawful basis gap — most commonly undocumented legitimate interest assessments or consent mechanisms that do not meet GDPR Article 7 standards.
The jurisdiction that will cause the most compliance pain for multinational organizations over the next 24 months is not China. It is India. The DPDPA's implementing rules are still being finalized, enforcement will begin before most organizations have completed their first gap assessment, and the penalty structure is aggressive.
The fine that came from data they forgot they had
A Thai SaaS provider selling project management software to European SMBs received a GDPR enforcement notice from a EU supervisory authority eighteen months after their last internal compliance review. The review had concluded they were compliant. The fine was not for their primary product data. It was for a marketing analytics integration — a third-party tool added by the growth team — that was writing EU user behavioral data to servers in Singapore without a valid transfer mechanism. No SCCs. No adequacy basis. Just a default configuration in a SaaS tool that nobody had reviewed at onboarding.
The integration had been running for 26 months. The data included email addresses, IP addresses, session behavior, and inferred location. Under GDPR Article 44, every one of those transfers was unlawful from day one.
This is the pattern we see consistently in APAC organizations with GDPR exposure: the primary product gets the compliance attention, and the ecosystem of integrations, analytics tools, and third-party processors operates outside the compliance perimeter entirely. The breach did not come from the core system. It came from a tool the compliance team did not know existed.
When we ran the data processing inventory, we found 14 active third-party integrations writing EU personal data to non-EU infrastructure. The organization had documented 3 of them. The gap between what the DPA record showed and what was actually happening in production is the most common finding in our APAC GDPR assessments — and it is the gap that regulators are most likely to find during a breach investigation.
Why GDPR and APAC privacy laws conflict in ways that matter operationally
The surface-level framing of 'GDPR vs APAC privacy laws' implies a choice between frameworks. That is the wrong mental model. Most APAC organizations with EU customer exposure have to comply with both simultaneously — and in several areas, the requirements point in opposite directions.
The most operationally significant conflicts are not theoretical edge cases. They come up in routine data handling decisions.
Consent standards diverge sharply. GDPR Article 7 requires consent to be freely given, specific, informed, and unambiguous — with the burden of proof on the controller. Singapore's PDPA permits deemed consent in several scenarios: where an individual voluntarily provides data in a context where the purpose is obvious, or where they have been notified and given a reasonable opportunity to opt out. A consent mechanism designed to satisfy PDPA deemed consent will frequently fail GDPR Article 7. Organizations that built their consent architecture against Singapore's standard and then acquired EU customers are running an unlawful basis for processing EU data, even if their Singapore compliance posture is clean.
Data localization creates direct conflicts with GDPR transfer rules. China's PIPL imposes data localization requirements for Critical Information Infrastructure operators and organizations above volume thresholds — personal data on Chinese residents must stay in China in these cases, or pass through a security assessment process. GDPR does not impose localization but restricts transfers to jurisdictions without adequate protection. An organization with Chinese resident data and EU resident data in a single data lake has a structural conflict: the architecture that satisfies PIPL localization may violate GDPR transfer restrictions, and vice versa. The only workable solution is architectural separation, which most organizations have not built.
Retention obligations conflict. Several APAC financial regulators require data to be retained for 5-7 years for audit and anti-money-laundering purposes. GDPR's data minimization and storage limitation principles under Article 5(1)(e) require deletion when data is no longer necessary for the original purpose. For fintech companies processing EU customer financial data in APAC jurisdictions, the regulatory retention floor and the GDPR deletion ceiling can be the same data, on the same timeline, with opposing requirements. Article 89's research and archiving exemptions are often cited as the solution — in practice, they are narrow and frequently invoked without the safeguards the Article actually requires.
Example
A Singapore-based payments company serving both EU and APAC markets built a unified customer data platform to reduce operational cost. The architecture satisfied MAS Notice 655 requirements for data residency. It violated GDPR Chapter V because EU customer data was being processed on infrastructure in jurisdictions without adequacy decisions, under contracts that did not constitute valid SCCs. The same architecture. Two regulators. Contradictory verdicts.
What our assessments found across APAC organizations with GDPR exposure
Assessment base: Gap analysis, data processing inventory, and post-incident regulatory response engagements across fintech, SaaS, and e-commerce organizations headquartered in Singapore, Australia, India, and Thailand, processing EU personal data
67% had at least one active lawful basis gap for EU data processing
Across gap analysis engagements with APAC-headquartered companies processing EU personal data, the most common finding is not a missing privacy policy or absent DPA record. It is an active processing operation — typically in marketing, analytics, or fraud detection — where the documented lawful basis does not hold under scrutiny. The most common failure mode: legitimate interest listed as the basis without a completed Legitimate Interests Assessment. Controllers who list LIA as their basis without documented balancing tests are not compliant under GDPR Article 6(1)(f). Regulators have specifically flagged this in enforcement actions. We find it in the majority of APAC organizations that self-report as GDPR compliant.
The average APAC organization has 11 active third-party data processors not reflected in their Article 30 record
Article 30 requires controllers to maintain a record of processing activities, including the categories of recipients and any transfers to third countries. In practice, the Article 30 record is built once during initial compliance implementation and then drifts as the organization adds tools, integrations, and vendors. The average gap we find is 11 processors — real, active processors writing or reading EU personal data — that are not in the record. The majority are SaaS analytics tools, marketing automation platforms, and customer support integrations added by non-compliance teams without a DPIA review or DPA agreement in place.
Cross-border transfer mechanisms are the most common enforcement trigger, and the least maintained control
Post-Schrems II, transfer mechanisms require active maintenance — SCCs must reflect the 2021 module structure, TIAs must be documented and reviewed, and the legal basis for transfer must be re-evaluated when the recipient country's legal environment changes. In our assessments, 58% of APAC organizations with EU data flows had transfer mechanisms that were either missing entirely, based on the pre-Schrems II Privacy Shield framework (invalidated), or using outdated SCC templates. None of these organizations believed their transfer mechanisms were out of compliance.
DSAR response capability is theoretical in most organizations
GDPR Articles 15-22 give data subjects rights including access, rectification, erasure, and portability — each with specific response timelines. In tabletop exercises where we simulate a DSAR across the organization's actual data infrastructure, the average time to produce a complete, accurate response is 34 days for access requests and 47 days for erasure. The GDPR deadline is 30 days for most requests. The gap is not a process failure — organizations have DSAR processes. It is a data visibility failure: they cannot locate all the places a given individual's data resides, particularly across the third-party integrations not reflected in their Article 30 record.
How each major APAC jurisdiction actually compares to GDPR — the specifics that matter
PDPA permits deemed consent in ways GDPR does not. Data portability rights are narrower. No equivalent to GDPR's DPO mandatory appointment requirement for controllers processing at scale. The PDPA does not have GDPR's tiered penalty structure — maximum fine is SGD 1 million (approximately EUR 700k), well below GDPR's 4% of global turnover. Cross-border transfer mechanism under PDPA Third Schedule is not equivalent to GDPR SCCs — a contract that satisfies PDPA transfer requirements does not automatically satisfy GDPR Chapter V.
Singapore is the easiest APAC jurisdiction to run alongside GDPR because the PDPA's accountability model is similar in structure. The consent and transfer gaps are manageable with dual-track documentation. The DPO appointment gap is the most commonly missed: organizations that are not required to appoint a DPO under PDPA but process EU data at scale may be required to appoint one under GDPR Article 37.
PIPL's consent requirements are stricter than GDPR in some respects — separate consent is required for each processing purpose, and consent cannot be bundled. Data localization obligations for CII operators and high-volume processors have no GDPR equivalent. Cross-border transfers require either a CAC security assessment, a standard contract filed with the CAC, or certification — a fundamentally different mechanism from GDPR's SCC approach. The territorial scope of PIPL is broader than GDPR in some readings: it applies to processing of Chinese residents' data even for purposes of analyzing behavior outside China.
For organizations with both EU and Chinese resident data, PIPL and GDPR are close to architecturally incompatible if you try to run them on a unified data infrastructure. The localization requirement for Chinese resident data and the transfer restrictions for EU resident data pull in opposite directions. The only organizations handling this well have built explicit data residency separation at the infrastructure level, with separate processing environments for each population.
The DPDPA passed in 2023 but implementing rules are not yet finalized as of early 2026. The framework borrows heavily from GDPR in structure — consent requirements, data principal rights, data fiduciary obligations — but several critical operational details are delegated to rules that have not been published. Cross-border transfer restrictions are significant: transfers are permitted only to countries notified by the central government, and the positive list has not yet been published. The penalty structure is aggressive: up to INR 250 crore (approximately EUR 27 million) per violation, without the GDPR proportionality mechanism tied to global turnover.
This is the jurisdiction most organizations are underestimating. The rules are pending but enforcement will begin once they are published — and organizations that wait for the rules before starting their compliance program will have a 6-12 month gap. Start the data inventory and consent architecture review now. The structural requirements are clear enough from the Act itself. The details that remain pending are mostly about specific approved countries and Significant Data Fiduciary thresholds.
The Privacy Act is undergoing significant reform following the 2022 review. The proposed changes include a direct right of action for individuals, a statutory tort for serious invasions of privacy, and expanded obligations for handling children's data. Current enforcement is through the OAIC, with a maximum civil penalty of AUD 50 million — introduced in 2022 and significantly higher than pre-reform levels. The Australian Privacy Principles do not have GDPR's granular consent and lawful basis requirements, but the reform trajectory is clearly toward GDPR-style obligations.
Australia is moving toward GDPR alignment, but is not there yet. Organizations that build toward GDPR standards for their Australian operations are making a defensible strategic choice — the reform direction makes it likely that GDPR-aligned practices will satisfy future Australian requirements. The near-term gap to watch is the children's data proposals, which would impose obligations that go beyond current GDPR requirements in some respects.
Thailand's PDPA is structurally the closest to GDPR of any APAC framework — it uses a lawful basis model, has DPO requirements, mandates DPIAs for high-risk processing, and has breach notification obligations. Consent requirements align closely with GDPR Article 7. The main operational divergence is enforcement maturity: the PDPA enforcement infrastructure is still developing, which has led some organizations to treat it as lower priority. That is a mistake — the framework obligations are real regardless of current enforcement intensity.
Organizations that are GDPR compliant and operating in Thailand have the smallest gap to close of any APAC jurisdiction. The primary compliance task is localization of documentation and ensuring the Thai DPO appointment and breach notification pathways are distinct from the EU processes — regulators expect jurisdiction-specific evidence, not global policy documents translated into Thai.
The compliance gaps that APAC organizations consistently miss
The SaaS tool that became a processor overnight
When an organization adds a new SaaS integration — analytics, support, marketing automation — and that tool processes EU personal data, it becomes a data processor under GDPR the moment the first EU data flows into it. A Data Processing Agreement must exist before data flows begin, not after. In practice, DPAs are negotiated retroactively if at all, often using the vendor's standard template which may not satisfy GDPR Article 28 requirements. The Article 30 record is not updated. The TIA is not conducted. Organizations have processors they legally cannot use until these steps are complete — and they are using them anyway.
Consent that was valid when collected and is not valid now
GDPR consent requirements tightened following enforcement guidance from supervisory authorities, particularly around cookie consent and bundled consent. Organizations that collected consent before 2021 under practices that were then considered acceptable may now be holding consent records that do not satisfy current standards. The consent was collected. It was not re-collected when the standard changed. Processing that continues against those older consent records is technically proceeding on an invalid lawful basis. This is particularly acute for APAC organizations that built consent mechanisms against early GDPR guidance and have not revisited them.
The employee data gap in APAC offices
GDPR's territorial scope applies to EU data subjects, which includes EU resident employees of APAC-headquartered companies. HR data — payroll, performance records, health information, travel data — for employees based in EU countries is in scope even if the employer is headquartered in Singapore or Mumbai. APAC companies with European offices consistently underestimate this exposure. Employee data processing is often handled by regional HR teams using systems that were not procured with GDPR in mind, using lawful bases that do not hold under GDPR's employment data standards.
The PIPL volume threshold that triggers localization
PIPL's data localization requirement is not universal — it applies to Critical Information Infrastructure operators and to processors who handle personal information above a threshold set by the CAC. The current threshold is 1 million individuals. Organizations that were below this threshold when they assessed their PIPL obligations may have crossed it through organic growth without triggering a compliance review. There is no automated notification when you cross the threshold. The obligation attaches the moment you exceed it. Organizations with Chinese operations should be tracking their processing volumes against this threshold as a routine operational metric.
How to build a compliance architecture that covers both GDPR and APAC obligations
- Step 1
Build the data processing inventory from the outside in
Output:A complete map of where EU personal data flows, including all third-party processors, with their jurisdiction of processing and current transfer mechanism status.
Purpose:Do not start from your internal systems documentation. Start from your network traffic. What external endpoints are EU personal data being sent to? What third-party tools have API integrations that read from your customer database? The gap between the Article 30 record and the actual data flows is where your highest-risk exposures live. Use network-level discovery before relying on internal records.
- Step 2
Assess lawful basis for each processing operation — not each system
Output:A purpose-level lawful basis register with documented LIAs for each legitimate interest claim and consent records for each consent-based purpose.
Purpose:Most organizations document lawful basis at the system level: 'CRM — legitimate interest.' The GDPR requires a lawful basis for each processing purpose, not each system. A CRM may involve dozens of processing purposes: sales outreach, customer support, fraud detection, marketing analytics, product improvement. Each requires its own basis. Where legitimate interest is used, a documented LIA must exist showing the balancing test was conducted.
- Step 3
Audit transfer mechanisms against post-Schrems II requirements
Output:A transfer mechanism register with TIA status, review date, and a flagged list of transfers that require remediation.
Purpose:For every data flow from the EU or involving EU personal data to a third country, confirm: the transfer mechanism is current (2021 SCC modules, not pre-2021 templates), a Transfer Impact Assessment has been conducted documenting the legal environment of the recipient country, and the TIA has been reviewed within the last 12 months or following any significant change in the recipient country's surveillance law.
- Step 4
Build jurisdiction-specific compliance layers over a common data infrastructure
Output:A data architecture that enforces jurisdiction-specific obligations programmatically rather than through manual process, with audit logs that can demonstrate compliance to any of the applicable regulators.
Purpose:The organizations managing GDPR and APAC obligations most effectively are not running separate compliance programs per jurisdiction. They are running a common data infrastructure with jurisdiction-specific consent collection, retention rules, transfer restrictions, and subject rights workflows applied at the individual data record level. This requires tagging data at collection with the subject's jurisdiction so that downstream processing can apply the correct rules automatically.
- Step 5
Test DSAR response capability against real data, not tabletop assumptions
Output:A realistic DSAR response time baseline, a list of data locations that could not be searched automatically, and a remediation plan for the manual gaps.
Purpose:Run a simulated DSAR for a real test individual across your actual data infrastructure. Measure how long it takes to locate all instances of that individual's data across production systems, backups, third-party processors, and archived records. The result will be longer than your policy says it should be. The gap between your documented process time and your actual time is your regulatory risk.
What the next wave of APAC-GDPR enforcement will look like
India's DPDPA will produce the first major enforcement action against an APAC-headquartered company within 12 months of the implementing rules being finalized, and it will involve an organization that believed its GDPR compliance program covered its India obligations.
The DPDPA borrows GDPR's structure but diverges in ways that are not obvious without a jurisdiction-specific gap analysis. Organizations that mapped their GDPR program against the DPDPA Act text and concluded they were covered have not accounted for the rules-level obligations that will introduce sector-specific requirements, approved country lists for transfers, and Significant Data Fiduciary obligations that trigger additional operational requirements. The penalty is aggressive and not proportional to global turnover — a penalty that would be modest under GDPR's 4% cap could be materially higher under DPDPA's fixed ceiling for a mid-size organization.
Confidence: highIf, by 24 months after DPDPA implementing rules are finalized, there are no enforcement actions against organizations that had documented GDPR compliance programs, this prediction is wrong.The next significant GDPR enforcement action originating from APAC data flows will involve employee data, not customer data — specifically HR processing by an APAC-headquartered multinational with EU offices.
Customer data GDPR compliance has received significant attention across APAC organizations with EU exposure. Employee data has not. HR systems used in APAC regional offices are frequently not procured with GDPR in mind, the lawful bases for employee data processing are less well understood than for customer data, and the special category data involved — health, biometric, union membership — carries higher enforcement risk. Supervisory authorities in several EU member states have specifically flagged employment data as a priority enforcement area.
Confidence: mediumIf the next major GDPR enforcement action with an APAC nexus does not involve employee data as a primary or contributing element, this prediction should be reassessed.
The framing of GDPR vs APAC is the problem
The compliance industry has sold the GDPR vs APAC question as a framework choice — which standard should we adopt, GDPR or local law? That framing is wrong and it produces bad outcomes. Organizations that chose GDPR as their global standard assumed it covered their APAC obligations. It does not — PIPL localization, PDPA deemed consent, and DPDPA transfer mechanisms are not resolved by GDPR compliance. Organizations that chose local law as their standard assumed it covered their GDPR obligations. It does not — Singapore PDPA consent does not satisfy GDPR Article 7, and PDPA breach notification timelines are different from GDPR Article 33.
The right framing is: what does each jurisdiction require, where do they conflict, and how do we build an architecture that can satisfy all of them simultaneously? That question is harder to answer and more expensive to solve than picking a framework. But it is the question that reflects the actual legal situation for any APAC organization with EU data flows.
Where to start if you are behind on this
The organizations that handle GDPR-APAC compliance well are not the ones with the most sophisticated legal teams. They are the ones with the most accurate picture of where their data actually goes. Every compliance program in this space breaks down at the same point: the gap between the documented data processing record and the actual data flows in production. Start there.
Build the inventory from network traffic, not internal documentation. Test your DSAR response time against real data. Audit your transfer mechanisms against the post-Schrems II standard. And if you have EU-resident employees in your APAC-headquartered company, treat their HR data as in-scope for GDPR — because it is, and it is the gap most likely to produce an enforcement action over the next 24 months.
The jurisdictional comparison matters, but it matters second. You cannot close the right gaps if you do not know where your data is.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint analysisUS federal cybersecurity frameworks: the complete guide to all 37 mandates
CISA cybersecurity performance goalsNational Vulnerability Database NIST
NIST National Vulnerability DatabaseNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkUnderstanding Compliance Gap Analysis
compliance gap analysis guide
Frequently Asked Questions
How can I conduct a CISA CPG compliance assessment?
Conducting a CISA CPG compliance assessment involves understanding the CPG's control families, mapping them to your existing security program, and systematically evaluating your implementation. Review technical configurations, interview key personnel, and meticulously document your findings against each control in the CPG framework. Start with your most critical systems and data flows.
What are the key control areas within the CISA CPG?
The CISA CPG organizes controls into several key areas, including asset management, vulnerability management, access control, incident response, and network security. Each area contains specific controls designed to mitigate risks across critical infrastructure. Understanding these control families is crucial for prioritization during your compliance assessment.
How often should I update my CISA CPG compliance assessment?
You should update your CISA CPG compliance assessment at least annually, or more frequently if there are significant changes to your infrastructure, applications, or threat landscape. Vulnox assessments reveal that 36% of General-compliant configurations become non-compliant within 90 days due to unapplied patches, emphasizing the need for continuous monitoring.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.