Which standards require a legal and regulatory register?

ISO/IEC 27001:2022: 5.31; ISO/IEC 27701:2025: A.1.2.3; ISO 22301:2019: 4.2.2.

What must a legal and regulatory register contain under ISO 27001?

5.31: Identify, document and keep current the legal and contractual obligations relevant to security, and your approach to meeting them. The ISO 27002 guidance beside 5.31: Requires the legal, statutory, regulatory and contractual requirements bearing on information security, and the organisation's approach to meeting them, to be identified, documented and kept up to date.

Who should own the legal and regulatory register?

The clauses imply legal or the compliance officer. The register names the role so the line on your list can carry a name.

How often should a legal and regulatory register be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a legal and regulatory register?

Yes: https://compliance.theartofservice.com/policy-templates/legal-and-regulatory-register-template

Every policy type · Governance and the management system

Legal and regulatory register

The list of the laws, regulations and contractual terms the organisation answers to, with the owner of each and how compliance is shown.

How the register reads it

Also called	compliance register, obligations register, applicable laws
Family	Governance and the management system
Document type	Record. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected owner	Legal or the compliance officer.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 or ISO 22301 is ticked and no line resolves to it (ISO 27701 requires it too, inside a parent document, so it does not list it separately).
Template	Legal and regulatory register template.

Which standards require it, and what each expects it to contain

3 requiring clauses, 3 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.31 Legal, statutory, regulatory and contractual requirements

Identify, document and keep current the legal and contractual obligations relevant to security, and your approach to meeting them.

What the ISO 27002 guidance expects the document to say: Requires the legal, statutory, regulatory and contractual requirements bearing on information security, and the organisation's approach to meeting them, to be identified, documented and kept up to date.

Evidence an auditor accepts: The register of legal, statutory, regulatory and contractual requirements relevant to information security, per jurisdiction of operation; the documented approach to meeting each requirement, with the control or process that satisfies it; evidence the register is maintained, showing how new and changed obligations are identified and the date of the last update
Common gap: outdated legal register
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.1.2.3 Identify lawful basis

The organization must determine, document and comply with the lawful basis for each processing activity against its identified purposes, documenting the basis per activity, including any special categories of personal data in its classification scheme with awareness that the classification and its consequences vary by jurisdiction and regime, and revisiting the basis and any need for fresh consent whenever purposes change or extend.

Evidence an auditor accepts: Lawful basis recorded against each processing activity, with the reasoning; where legitimate interests is relied on, the balancing against obligations to individuals; classification scheme entries covering special categories, mapped to the jurisdictions that define them
Common gap: Consent recorded as the basis for processing that is in fact contractual, creating a withdrawal right the organization cannot honour
Source: ISO/IEC 27701:2025

ISO 22301:2019

ISO 22301 4.2.2 Legal and regulatory requirements

Run and maintain a process that finds, obtains access to and assesses the legal and regulatory requirements applying to the continuity of the organization's products, services, activities and resources, ensure those requirements are reflected in how the BCMS is built and run, and keep that information documented and current.

Evidence an auditor accepts: Documented process for identifying and assessing continuity related legal and regulatory requirements; current obligations register with source, applicability and assessment date; traceability from an obligation to the BCMS element that satisfies it
Common gap: Obligations register held by legal and never reconciled against the BCMS
Source: ISO 22301:2019

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Internal audit charter and programme · Management review procedure