What It Is

ISO 26000:2010 is a voluntary international guidance standard on social responsibility (SR), applicable to all organizations regardless of size, type, or location. Its primary purpose is to provide a shared definition of SR, principles, and core subjects to assess impacts, engage stakeholders, and integrate responsible practices holistically, using a contextual, stakeholder-driven approach rather than requirements.

Key Components

• **Seven core subjectsorganizational governance, human rights, labor practices, environment, fair operating practices, consumer issues, community involvement.
• **Seven principlesaccountability, transparency, ethical behavior, respect for stakeholder interests, rule of law, international norms, human rights.
• Built on multi-stakeholder consensus; non-certifiable model emphasizes self-assessment, transparent reporting, and integration with management systems like ISO 14001/45001.

Why Organizations Use It

Enhances sustainability commitment, risk management, ESG alignment, and stakeholder trust without certification burdens. Drives operational resilience, regulatory preparedness (e.g., CSDDD), competitive differentiation, and credibility in reporting.

Implementation Overview

Phased approach: materiality assessment, stakeholder engagement, policy integration, training, supplier due diligence, KPIs, and transparent communication via ISO's protocol. Suited for all sectors/geographies; no audits required, focuses on embedding SR in governance and operations. (178 words)

What It Is

UK General Data Protection Regulation (UK GDPR) is the UK's post-Brexit data protection law, adapting EU GDPR with the Data Protection Act 2018. It is a binding regulation enforcing risk-based, accountability-focused principles on personal data processing by controllers and processors.

Key Components

• Seven core principles: lawfulness, purpose limitation, minimisation, accuracy, storage limitation, security, accountability.
• Data subject rights (access, rectification, erasure, portability, objection).
• Controller/processor obligations (RoPAs, contracts, DPIAs, breach notification).
• ICO enforcement with fines up to 4% global turnover; no formal certification, but demonstrable compliance required.

Why Organizations Use It

• Mandatory for UK-established or targeting entities; avoids massive fines (£17.5M max).
• Builds trust, reduces breach risks, enables cross-border operations.
• Strategic benefits: data governance efficiency, competitive privacy differentiation.

Implementation Overview

Phased approach: governance setup, data mapping (RoPA), policies/contracts, DPIAs, training, audits. Applies to all sizes handling UK personal data; ICO audits focus on evidence.