San Marino Law 171/2018 on Data Protection
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | SM Law 171 |
| Region | Europe |
| Country or scope | San Marino |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers SM Law 171
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
SM-171-SEC Security of Processing | Controllers and processors must adopt appropriate technical and organizational measures ensuring the integrity and confidentiality of processing systems; integrity hashes across processing components evidence those measures (Law 171/2018, GDPR Art. 32-equivalent security obligation) | Scan |
SM-171-REC Records of Processing Activities | Controllers must maintain records of their processing activities, which requires an enumerable, named inventory of the software components performing the processing (Law 171/2018, GDPR Art. 30-equivalent record-keeping duty) | Scan |
SM-171-PROC Processor Guarantees | Processing on behalf of a controller may be entrusted only to processors offering sufficient guarantees, so third-party software components must carry named, accountable suppliers (Law 171/2018, GDPR Art. 28-equivalent processor obligations) | Scan |
SM-171-BREACH Breach Notification Readiness | Personal-data breaches must be notified to the Garante without undue delay, which requires that affected components are identifiable via standard identifiers to assess breach scope quickly (Law 171/2018, GDPR Art. 33-equivalent breach-notification duty) | Scan |
SM-171-ACCU Accuracy Principle | Personal data must be accurate and kept up to date, presuming each processing component is fully identified by both name and a concrete version (Law 171/2018, GDPR Art. 5-equivalent processing principles) | Scan |
SM-171-TRANS Transparent Processing | Controllers owe data subjects transparent information about processing, which presupposes documented, uniquely identified and timestamped records of the processing environment (Law 171/2018, GDPR Art. 12-equivalent transparency duty) | Scan |
Policy templates
All 22 from the standard set, adapted to SM Law 171.
Russia Federal Law 187-FZ on Critical Information Infrastructure
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
Serbia Law on Personal Data Protection 2018
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.