Legal, Regulatory & Contractual Requirements Procedure¶

Purpose. Describes how Soon identifies the legal, regulatory and contractual requirements that affect its information security, keeps them documented, and reacts when they change.

1. Scope¶

Covers all legal and regulatory requirements relevant to information security and privacy for Soon (an EU-based SaaS processor of workforce data), plus security commitments made in customer contracts and DPAs.

2. Procedure¶

2.1 Identify applicable requirements¶

The currently identified requirements are summarised in Information Security Context, Requirements and Scope (ISMS-DOC-04-1), which includes the analysis of GDPR (Soon acts as data processor) and of NIS2 and the EU AI Act applicability. New requirements are identified through: legal/regulatory monitoring by the policy owner, external legal advice where needed, and customer contracts and security questionnaires.

2.2 Maintain a requirements register¶

Each applicable requirement is recorded in a requirements register with: source (law, regulation, contract), what it obliges Soon to do, the owner, and how Soon meets it (link to policy/control). The register is held in Google Drive (Soon shared drive). (Formerly asked to confirm the register location (spreadsheet or this repository).

2.3 Track contractual commitments¶

Security and privacy commitments made in customer DPAs and contracts (e.g. EU data residency, breach notification deadlines, sub-processor notice periods, deletion on termination) must be captured in the register so they are reflected in Soon's policies and operations. New or non-standard commitments must be reviewed for feasibility before the contract is signed.

2.4 Assess and implement changes¶

When a new or changed requirement is identified, the policy owner assesses: what must change in the ISMS, how urgent it is, and the consequences of non-compliance. Urgent changes are implemented immediately; others are scheduled into the ISMS improvement plan. The context document and register are updated.

2.5 Review¶

The register and the applicability analysis are reviewed annually as part of the ISMS management review, and additionally whenever Soon's business changes materially (new markets, new data types, new regulations such as NIS2 implementation acts or AI Act guidance).

3. Roles & responsibilities¶

Policy owner (Olaf Jacobson, ISM) (internal accountability sits with Olaf Jacobson as ISMS owner)** — maintains the register, runs the annual review, obtains legal advice when needed.
Whoever signs customer contracts — routes non-standard security commitments for review before signature.

Change log¶

Version	Date	Author	Comments
0.1	2023-12-11	Olaf Jacobson	First draft document
0.2	2026-07-18	Andrea Cardinali	Rewritten lean and Soon-specific (ISMS overhaul) — compact procedure grounded in GDPR-as-processor, NIS2/EU AI Act analysis and customer DPA commitments