What is a legal register?
A legal register breaks the laws, regulations and contracts that apply to a company down into individual, checkable obligations and records for each who meets it and what proves it. The term comes from environmental and occupational safety management, where sites record permit conditions, limit values and inspection deadlines. In information security it does the same for data protection, IT security law and contractual security commitments. When you implement an ISMS, you set it up alongside the scope and the interested parties.
The terms legal register, register of legal requirements and obligations register are largely used as synonyms. Where a distinction is made, the register of legal requirements is the list of provisions and the legal register is the breakdown into individual obligations with an owner, an assessment and evidence. That breakdown is what matters: "GDPR" cannot be assessed as met, but Article 32 GDPR for a specific system can.
Is a legal register mandatory?
No German law requires a document by this name. What is required is to know the obligations that apply, to comply with them and to be able to prove it; management system standards turn that into a documented requirement.
| Standard | What it requires | Relevance to the legal register |
|---|---|---|
| ISO/IEC 27001 | clause 4.2: determine the requirements of interested parties, including legal and contractual ones; Annex A 5.31: identify, document and keep up to date the relevant legal, regulatory and contractual requirements | the legal register is the usual form of this evidence |
| ISO 14001 and ISO 45001 | determine compliance obligations or legal requirements, keep them available and evaluate compliance | where the classic legal register comes from; both can be run together with the ISMS register |
Management's organizational responsibility applies as well. Under § 130(1) of the German Administrative Offences Act (OWiG), the owner of a business or company who fails to take the required supervisory measures commits an administrative offence. This applies if an offence is committed as a result that proper supervision would have prevented or made significantly more difficult (our translation). A maintained register shows that supervision of obligations is organized.
Template: one register entry with eight fields
A usable entry describes a single obligation, not an entire law. Fictional example for a mid-sized company; the details and dates are invented:
| Field | Content | Example |
|---|---|---|
| Source | legal act with article or section, paragraph and number | Article 32(1) GDPR |
| Obligation in your own words | what exactly has to be done | protect systems holding personal data with technical and organizational measures appropriate to the risk |
| Applicability | applies, applies in part or does not apply, each with a reason | applies to all systems holding personal data |
| Areas and systems affected | processes, applications, cloud services, service providers | HR administration, CRM, payroll provider |
| Responsible person | a named person, not a team | head of IT operations |
| Evidence | document, configuration, log, report | description of measures, report of the last access review |
| Compliance assessment | met, partly met or not met, with a date | partly met on 15 Sep 2026: encryption of the CRM export is missing |
| Last change review | when the source was last checked for legal changes | 1 Oct 2026 |
A provision that does not apply also gets an entry with a reason. In an audit it must be clear why it was excluded. A "partly met" assessment leads to a measure or goes into the risk assessment as a compliance risk.
Which laws belong in a legal register for information security?
Which provisions apply depends on industry, size, products and contracts. The overview is a starting point for companies in Germany, not an exhaustive list (as of October 2026).
| Provision | Applies to | Examples of individual obligations |
|---|---|---|
| GDPR, Regulation (EU) 2016/679 | anyone processing personal data | Article 28 processors, Article 30 records of processing activities, Article 32 security of processing, notification of personal data breaches without undue delay and, where feasible, within 72 hours (Article 33(1)) |
| German Federal Data Protection Act (BDSG) | controllers and processors in Germany | § 38(1) BDSG: appointment of a data protection officer where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data |
| BSI Act (BSIG) as amended by the NIS2 Implementation Act | particularly important entities (besonders wichtige Einrichtungen; "essential entities" in the NIS2 Directive) and important entities | § 30 BSIG risk management measures, § 32 reporting duties, § 33 registration, § 38 duties of management |
| DORA, Regulation (EU) 2022/2554 | financial entities | ICT risk management, incident reporting, resilience testing, ICT third-party risk |
| Cyber Resilience Act, Regulation (EU) 2024/2847 | manufacturers of products with digital elements | reporting duties under Article 14 since 11 September 2026, full application from 11 December 2027 (Article 71(2)) |
| Telecommunications Digital Services Data Protection Act (TDDDG) | providers of digital services and websites | storing and accessing information on end devices, for example through cookies (§ 25 TDDDG) |
| Trade Secrets Act (GeschGehG) | anyone with know-how worth protecting | protection as a trade secret only with appropriate confidentiality measures (§ 2 no. 1(b) GeschGehG) |
| Contracts | customers, service providers, insurers | security schedules, data processing agreements, SLAs, obligations under cyber insurance policies |
Under § 28(6) BSIG, §§ 30, 32 and 38 BSIG do not apply to financial entities under DORA. Under § 28(5) BSIG they do not in principle apply to operators of public telecommunications networks and certain energy supply networks. The "contracts" row belongs in the register explicitly, because ISO/IEC 27001 names contractual requirements alongside legal ones. Security commitments in customer contracts can be stricter and more specific than the law.
How do you create a legal register in 6 steps?
- Define the context: industry, sites, products, legal form and major customer contracts decide which areas of law may apply.
- Collect obligations: break every provision down to the individual obligation.
- Justify applicability, including for provisions you deliberately exclude.
- Assign ownership and context: every obligation gets a responsible person and the areas, systems or service providers where it is met.
- Assess and evidence compliance: record whether the obligation is met and what proves it.
- Set up a change process: decide who monitors legal changes, on what cycle reviews take place and how the results reach the management review.
How often is a legal register updated?
The standards set no fixed cycle; they require an up-to-date register. Set a regular review for legal changes, for example quarterly, and review additionally when something happens. Triggers include new laws such as the NIS2 Implementation Act, in force since 6 December 2025, new products, sites or major customer contracts, and audit findings. Record the date and result of every review.
Template or legal register software?
A spreadsheet template with the eight fields is enough to start with and for organizations with a manageable legal framework. Its limits show in three questions: who notices a legal change? Who is notified when an obligation affects them? Where is the evidence for the entry?
Software with an editorial update service answers the first question. It answers the second and third only if the register is connected to the systems, processes and people where the obligation is met.
Why a legal register fails in an audit
- Laws are listed, individual obligations are not.
- Contractual obligations are missing, although the standard explicitly includes them.
- The "responsible" column names a department instead of a person.
- The compliance assessment is older than the last legal change.
- The register sits beside the management system: no entry leads to a measure, a risk or evidence.
Legal register in Rizzqo
In Rizzqo, the obligations of frameworks and laws such as ISO 27001, DORA or the Cyber Resilience Act are attached to the systems they apply to. Each obligation goes to the right person, who answers it and uploads evidence. For every answer you see on which system it was given, who gave it and whether the obligation is met or still open.