---
title: "Scope and ownership · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/scope-and-ownership
updated: 2026-10-20
licence: "All rights reserved"
---

# Scope and ownership

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Decide which laws and standards apply from recorded facts, give every duty one owner, and keep every legal date in one calendar that warns you.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/scope-and-ownership`.

## Required

- [Keep a register of every duty that applies](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register): Keep one register in the repository of every law, standard and contract duty you screened. Give each its decision, reason, owner and next review date.
- [Derive scope from recorded facts](https://agentwranglers.se/playbook/compliance/scope-and-ownership/scope-from-facts): Store the facts that decide which laws apply, such as headcount, turnover, countries served and product types, and compute each threshold in code.
- [Give every duty one named owner](https://agentwranglers.se/playbook/compliance/scope-and-ownership/named-owners): Give every duty, control and register one named person as owner and one as deputy. A team name is not an owner.
- [Keep every legal date in one calendar](https://agentwranglers.se/playbook/compliance/scope-and-ownership/compliance-calendar): Generate one calendar from the registers with every review date, contract renewal, legal start date and audit certificate expiry. Warn owners 30 days before each. Audit certificates include ISO 27001. TLS certificates follow [certificate renewal](https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal) instead.
- [Decide whether you need a data protection officer](https://agentwranglers.se/playbook/compliance/scope-and-ownership/dpo-decision): Record whether GDPR Article 37 requires a data protection officer, with the reason. If it does, publish the contact and tell the supervisory authority.
- [Name a representative when you serve the EU from outside](https://agentwranglers.se/playbook/compliance/scope-and-ownership/eu-representative): If you have no EU office but offer goods or services to people in the EU, appoint an EU representative in writing. GDPR Article 27 requires it.

- Next: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map)
- [All chapters](https://agentwranglers.se/playbook/compliance)