Alexander Vassbotn Røyne-Helgesen PRO
Lover of life, technologist at heart
Compliance briefing
GDPR, ISO 27001, accessibility and the other rules in our markets: what applies, what we found, what to do first.
Alexander · Tech Lead
What this is, and what it is not
- BasisCode, configuration and public sourcesWhat the discovery found, mapped to the rules. Statuses of laws checked 15 October.
- NotLegal adviceWhich rules apply, and how, needs legal counsel. Those rows say "to confirm".
- MarketsUK, Norway, Sweden, then EU / EEARules for future markets are included, so new customers do not surprise us.
The deck is generated from the findings register (doc 26), so it stays current as findings are added.
Most gaps are basics we already plan to fix
14rules mapped across our markets
30open findings in the register
14of them high priority
12need legal confirmation
Security gaps are compliance gaps. Weak tenant isolation, no alerting and no retention rules show up under GDPR, ISO 27001 and the new EU cyber rules alike. Fixing them once helps everywhere.
Confidential. Generated 2026-10-19 from doc 26 (regulatory map and findings register, 30 findings). Not legal advice.
01
What applies
The rules that apply to us
| Rule | Markets | In force |
|---|---|---|
| GDPR and national data protection acts (NO personopplysningsloven, SE dataskyddslagen) | NO, SE, EU / EEA | In force |
| UK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025 | UK | Main changes in force since 5 February 2026 |
| ISO/IEC 27001:2022 (a standard, not law) | UK (commercial), all | Target; date open (Q-048) |
| Accessibility: Norwegian universal-design rules, the European Accessibility Act (Directive 2019/882), UK Equality Act 2010 | All | NO in force; EAA applies in the EU since 28 June 2025; EAA not yet in the EEA Agreement (under scrutiny) |
| Cyber Resilience Act (Regulation 2024/2847) | EU (EEA to confirm) | Reporting since 11 September 2026; all duties from 11 December 2027 |
| NIS2, Norway's Digital Security Act, UK Cyber Security and Resilience Bill | All | EU: national laws; NO: NIS1-level act since 1 October 2025, NIS2 awaits the EEA; UK: bill before Parliament |
More rules in our markets
| Rule | Markets | In force |
|---|---|---|
| EU Data Act (Regulation 2023/2854), switching between data processing services | EU (EEA to confirm) | Since 12 September 2025 |
| E-invoicing and bookkeeping (NO Bookkeeping Act amendments; national retention rules) | NO; retention all | NO e-invoicing from 1 January 2027 (adopted June 2026) |
| ePrivacy and cookies (NO Electronic Communications Act, national ePrivacy laws, UK PECR) | All | In force (NO stricter consent since 1 January 2025; UK relaxed analytics rules under the 2025 Act) |
| E-invoicing in Germany (VAT Act, from the Growth Opportunities Act; future market) | DE (future) | Receiving since 1 January 2025; issuing from 1 January 2027 above 800,000 euro prior-year turnover, from 1 January 2028 for all |
| Transport emissions and sustainability reporting: CountEmissionsEU (Regulation (EU) 2026/1030, method EN ISO 14083); CSRD after Omnibus I | EU (EEA to confirm); UK customers' clients | CountEmissionsEU in force 1 June 2026, applies from 2 December 2030; CSRD Omnibus I in force 18 March 2026 |
| eIDAS and UK e-signature law | All | In force |
More rules in our markets
| Rule | Markets | In force |
|---|---|---|
| EU AI Act | EU | Staged 2025–2027 |
| Transport rules: drivers' hours and tachographs (Regulation 561/2006, GB rules), working time of mobile road transport workers, bus and coach passenger rights (Regulation 181/2011) | All | In force |
02
What we found
GDPR: 9 findings, 3 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-01 | No register of processing; the data protection officer exists only in principle | All | High | Open |
| CMP-02 | No retention rules and no automatic deletion; deletion only on request | All | High | Open |
| CMP-03 | Processors and transfers unconfirmed: offshore supplier with production access, US SaaS tools, no data processing agreements seen | All | High | To confirm |
| CMP-04 | No tooling for access, export or erasure requests; no complaint handling for the UK duty | All | Medium | Open |
| CMP-05 | Personal data in application logs and error tracking | All | Medium | Open |
GDPR: 9 findings, 3 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-06 | Personal data copied between operators (test copies, shared reporting database, customer data warehouse) without a documented basis | All | Medium | To confirm |
| CMP-07 | Sensitive employee data held (national ID, passport, bank account, salary) without documented need or retention | All | Medium | Open |
| CMP-08 | Driver location tracking: operators need transparency and, in Norway, employee consultation; the product gives them no support. UK operators now ask for more of it (telematics geofences) | NO, UK, all | Medium | To confirm |
| CMP-09 | UK customers run in the production environment named "sweden" (the UK one holds none); data is in Ireland either way, but what customers were promised about location is unknown | UK | Low | To confirm |
Security of processing: 3 findings, 3 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-10 | Tenant isolation weaknesses can expose or change one operator's personal data from another (SEC-01, 02, 51) | All | High | Open |
| CMP-11 | Production database reachable from the internet | All | High | Open |
| CMP-12 | No alerting or error tracking, so a breach may not be noticed within 72 hours | All | High | Open |
ISO 27001: 4 findings, 4 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-13 | No ISMS yet: scope, risk assessment, Statement of Applicability, policies | UK (commercial) | High | Open |
| CMP-14 | Major control gaps: access control, incident management, backup and recovery, secure development | All | High | Open |
| CMP-15 | Supplier security: development and operations access sit with the offshore supplier, with no security requirements found | All | High | To confirm |
| CMP-16 | Every environment runs in the management cloud account with shared deploy keys | All | High | Open |
Accessibility: 3 findings, 1 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-17 | The live passenger web app is estimated below WCAG AA | All | High | Open |
| CMP-18 | No automated accessibility tests; staff, customer and partner portals not assessed | All | Medium | Open |
| CMP-19 | Operators' booking pages, e-tickets and the Ferd app may fall under the European Accessibility Act | EU / EEA | Medium | To confirm |
Cybersecurity law: 2 findings, 1 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-20 | Mobile apps may fall under the Cyber Resilience Act; no vulnerability-handling or reporting process exists | EU / EEA | High | To confirm |
| CMP-21 | Customers under NIS2 and national security laws will pass supplier-security requirements to Ferdia | All | Medium | To confirm |
Data portability: 1 finding, 0 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-22 | No customer data export for switching provider, as the EU Data Act requires of SaaS providers | EU / EEA | Medium | To confirm |
Invoicing and bookkeeping: 3 findings, 1 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-23 | Norwegian B2B e-invoicing (EHF) from 1 January 2027: EHF only through the Tripletex integration; invoices sent from TEQ by email are not EHF | NO | High | To confirm |
| CMP-24 | Accounting-record retention (years) and personal-data erasure are not designed together | All | Medium | Open |
| CMP-27 | Germany (candidate market): German e-invoices (XRechnung / ZUGFeRD) are not supported; issuing becomes mandatory from 2027–2028, receiving already applies | DE (future) | Medium | Open |
ePrivacy: 1 finding, 0 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-25 | Third-party scripts in the web apps (onboarding, chat, bot check) without a consent step found | All | Low | To confirm |
Ferd launch: 1 finding, 1 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-26 | Ferd stores passenger data and GPS location: privacy notice, consent, retention and an impact assessment are needed before launch | All | High | Open |
Transport rules: 1 finding, 0 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-28 | Driver rostering with UK operators is starting, but the drivers' hours and working-time rules (EU and GB) have not been assessed against planning and timesheets | UK, all | Medium | To confirm |
Sustainability reporting: 1 finding, 0 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-29 | Vehicles hold a CO2 value, Euro class and fuel, but there is no per-trip emissions figure, no ISO 14083 method, and /v2 does not expose the CO2 value | All | Low | Open |
Change management: 1 finding, 0 high
| ID | Finding | Markets | Priority | Status |
|---|---|---|---|---|
| CMP-30 | The new platform repositories sit in a GitHub organisation on the free plan: the main branch can't be protected and a production release can't require an approval. A plan upgrade is decided | All | Medium | In progress |
03
What to do
Four dates that matter now
- 11 Sep 2026EU cyber rules for apps: report exploited vulnerabilities (already in force)
- 1 Jan 2027Norway: B2B invoices must be EHF e-invoices
- 12 Jan 2027EU Data Act: no switching charges for cloud services
- 11 Dec 2027EU cyber rules for apps: all duties apply
Whether the cyber rules and the Data Act apply to us, and how, is for legal counsel to confirm.
Start with what every rule asks for
- Data protectionRegister, retention, processorsWrite the register, set retention, sign processor agreements.
- SecurityIsolation and detectionFix tenant isolation; add alerting to notice breaches in time.
- ISO 27001Scope the ISMS nowScope and risk assessment now; the audit needs months of evidence.
- CustomersEHF before 1 JanuaryCheck how Norwegian operators invoice from TEQ.
- ProductsAccessibility and FerdFix the passenger web app; Ferd's privacy work before launch.
- LegalConfirm the new rulesWhich of the app, accessibility and switching rules apply.
Five questions for legal counsel
- Who is our data protection officer, formally?
- Which processors and transfers need agreements now?
- How long must we keep each kind of record?
- Do the app, accessibility and data-switching rules apply to us?
- What must Ferd have in place before launch?
Questions
Alexander · Tech Lead
Ferdia CISO: Compliance briefing
By Alexander Vassbotn Røyne-Helgesen
