25+ privacy & security frameworks.
Answer once, comply everywhere.
Most companies sell across borders long before they have a privacy team. Answer a control once and TryTrustable carries that evidence into every regime you operate under, then tells you exactly what a new market costs before you enter it.
India
3 regimesData Fiduciary duties end to end
Europe & UK
7 regimesThe GDPR family plus the new AI and resilience law
Americas
3 regimesState-by-state privacy without state-by-state work
Asia-Pacific
5 regimesFive regimes, one control set
Middle East
3 regimesFederal and free-zone regimes
Security & assurance
7 regimesThe certifications your buyers ask for
AI governance
3 regimesEvidence your models the way you evidence your infrastructure
Frameworks are enabled explicitly, per organisation. Nothing is switched on for you at an invented readiness score.
See what a regime costs before you enable it
The mapping engine runs a delta: how many of the new regime's requirements your existing controls already satisfy, which are partial, and which need work you have not started.
- Overlap against every enabled framework
- Partial and unsatisfied requirements listed by reference
- Effort concentrated where it is genuinely new
- Custom frameworks authored the same way
Tell us where you sell.
We will map your current controls against every regime in that footprint and show you the gap list on the call.
Why one control answers many requirements
Frameworks look different and ask for the same things. Access review appears in SOC 2 as CC6.2, in ISO 27001 as A.5.18, in the DPDP Act as part of reasonable security safeguards under Section 8(5), and in the GDPR as Article 32. Four citations, one control, one set of evidence: if your model allows a control to be shared.
Most tools do not. They duplicate a control per requirement per framework, which is why adding a second framework feels like starting again and why the same screenshot ends up in four evidence folders. Our control library is shared by construction: roughly forty-five controls carry more than three hundred and fifty requirement mappings, and four consent controls alone satisfy fifteen requirements across DPDP, CCPA, SOC 2 and the GDPR.
| Region | What is covered | The thing people get wrong |
|---|---|---|
| India | DPDP Act 2023, DPDP Rules, CERT-In directions | Assuming GDPR work carries over. There is no general legitimate-interests basis, and notice must be available in English or an Eighth Schedule language |
| Europe & UK | GDPR, UK GDPR, ePrivacy, EU AI Act, NIS2, DORA | Treating UK GDPR as identical post-divergence, and forgetting ePrivacy governs cookies rather than the GDPR |
| Americas | CCPA/CPRA and comparable state laws, LGPD, PIPEDA | Applying an opt-in banner where the law is opt-out, and ignoring Global Privacy Control signals |
| Asia-Pacific | Singapore PDPA, Thailand PDPA, Australia Privacy Act, Japan APPI, Korea PIPA | Assuming one APAC posture. Consent, transfer and breach rules differ materially between them |
| Middle East | UAE PDPL, DIFC, ADGM | Treating the free zones as covered by the federal law; DIFC and ADGM have their own regimes |
| Security & AI | SOC 2, ISO 27001, ISO 27701, ISO 42001, NIST AI RMF | Planning ISO 27701 as a 2019-style extension of ISO 27001; the 2025 edition is certifiable on its own |
What a second framework actually costs
The honest answer is that it depends almost entirely on what you already did, which is why the mapping engine runs a delta before you enable anything. It reports three numbers: how many of the new regime's requirements your existing controls already satisfy, which are partially satisfied and need extending, and which need work you have not started.
In practice the overlaps are large and lopsided. A company with SOC 2 in place typically finds most of ISO 27001 Annex A already evidenced and almost none of DPDP's notice and consent obligations, because those sit in the product rather than in the infrastructure. Knowing that before you commit to a deadline is the difference between a quarter of work and a surprise.
Nothing is enabled for you
Frameworks are switched on explicitly, per organisation, and a requirement with no control mapped to it scores as not modelled rather than as satisfied or failed. That distinction sounds pedantic and it is the difference between a readiness figure you can defend and one you cannot.
It also rules out the practice this product exists to replace: platforms that present a new customer with a framework already showing thirty-four of forty-three requirements satisfied, on day one, before a single control has been tested. A dashboard that flatters you is worse than an empty one, because you will believe it right up until an auditor does not.
If you want to see where you stand before enabling anything, the readiness check scores the obligations that recur across all of these, and cross-framework mapping explains the machinery.
The things people ask us
How can one control satisfy several frameworks at once?
Because frameworks describe the same practices in different language. Access review is SOC 2 CC6.2, ISO 27001 A.5.18, GDPR Article 32 and part of DPDP Section 8(5) reasonable safeguards. One control test produces evidence that answers all four, provided the platform maps requirements to shared controls instead of duplicating a control per framework.
Does GDPR compliance mean I am DPDP compliant?
No. The obligations rhyme but the mechanics differ. DPDP has no general legitimate-interests basis, requires notice in English or an Eighth Schedule language, introduces the registered Consent Manager, and puts the burden of proving notice and consent squarely on the Data Fiduciary. Your GDPR work is a strong starting point, not a complete answer.
How do I know what a new framework will cost before enabling it?
The mapping engine runs a delta against your existing controls and reports what is already satisfied, what is partially satisfied, and what is unstarted, with each unsatisfied requirement listed by its own reference. Companies with SOC 2 usually find most of ISO 27001 covered and almost none of DPDP's notice and consent obligations.
What happens to a requirement with no control mapped to it?
It scores as not modelled, not as zero and not as satisfied. "We have not modelled this yet" and "we fail this" are different statements, and collapsing them produces a readiness number that cannot be defended in an audit.
Are frameworks enabled automatically?
No. Every framework is switched on explicitly, per organisation, and starts empty. Nothing is pre-marked satisfied at an invented readiness score, because a dashboard that flatters you is worse than an empty one.
Is ISO 27701 a standalone certification?
It is now. ISO/IEC 27701:2025, published in October 2025, is a standalone privacy information management system standard that can be certified without ISO 27001. The 2019 edition was an extension of ISO 27001 and could not be. Certificates to the 2019 edition have until October 2028 to transition.