Build an obligations register that changes the work
Connect each applicable requirement to a responsible owner, a practical control and evidence that it operates.
Read guideCompliance topic hub
Compliance management guidance and obligation registers
Compliance management identifies which requirements apply to an activity and turns them into accountable work. Keep the primary source, legal status, applicability rationale, owner, control, evidence and review trigger in the same record. An entry in a register is the start of a process, not proof of compliance.
Start with the right scope
A statute, regulatory rule, contract, official guidance and voluntary standard have different effects. Check the specific entity, activity, jurisdiction, threshold and commencement before recording a duty. For data protection, the ICO audit framework is aimed at larger organisations; smaller businesses should also use the ICO’s tailored resources. The framework does not guarantee compliance.
ICO: Data protection audit framework and its limits. Source reference baseline: 1 November 2026. AI-assisted preparation; no independent human legal review is claimed.
01
Check applicability
Read the operative source and distinguish current duties from proposals or future commencement.
02
Connect responsibility
Name the accountable role, operational control and evidence that should exist.
03
Monitor change
Record review triggers, findings, remedial actions and whether completion has been verified.
Compliance guides
Follow the question through its scope, evidence and next step.
UK GDPR accountability and DPIA triage
Connect data protection decisions to evidence, and identify when a project needs a data protection impact assessment.
Read guideAML scope and assurance: start with the activity
Identify the relevant AML regime, then connect the business risk assessment to controls, case evidence and review.
Read guideIncident and personal data breach escalation
Prepare a clear response route, assess harm and record the reasons for reporting or not reporting a personal data breach.
Read guideTraining and monitoring that test understanding
Turn policy awareness into role-specific decisions, then use monitoring results to improve the programme.
Read guideAn illustrative working example
A fictional business receives a revised supplier contract containing an incident-notification requirement. Its owner records the contractual clause and trigger separately from any statutory reporting duty. The team updates the escalation checklist, trains the relevant roles and records a scenario test. A completed checklist alone does not prove that every notification requirement has been identified.
Fictional example created to explain the method. It is not client work, original empirical research or an assurance conclusion.
Keep a useful working record
Browser-local obligations register gives you a practical place to record your own scope and evidence. Use the connected review workspace when you need to link risks, controls, obligations and actions.
What should an obligations register contain?
Record the requirement, authoritative source, legal status, applicability rationale, owner, control, evidence location, relevant deadline or trigger, and next review. Distinguish internal targets from legal deadlines.
Does an obligations register demonstrate compliance?
It helps organise responsibility and evidence. You must still assess whether the recorded requirement is correct, the control operates and the evidence is sufficient. The tool does not carry out that assessment for you.
Related implementation briefings
- The accountability review: what evidence should the board see?
- After commencement: turn data protection reform into controlled change
- FCA consults on a second phase of SM&CR reforms
Connect the disciplines
Read the GRC framework overview and worked example, then use the other topic hubs to connect the responsibility, exposure and requirement.