The 2025 reforms are a genuine advance. DORA reaches suppliers and covers availability at 25-0117. The UK Bill proposes staged reporting at 25-1119 and scope expansion at 25-1124. This file records what still falls outside.
Workforce Data
The corpus records 130,000 employee records at 25-0613 and, at 25-0704, that no public register exists for workforce exposure in any sector. Nothing in the 2025 reforms creates one. The most constrained data subject in this database — a person who cannot decline to hand over a national identifier and cannot leave without resigning — remains the least covered.
Availability Outside Regulated Sectors
DORA covers financial resilience. The Bill covers essential and digital services. The largest availability incidents in this corpus are a car manufacturer at 25-0902 and a food distributor at 25-0606 — neither obviously in scope of either.
A state that guaranteed £1.5 billion against the consequences of a manufacturing outage at 25-0928 has no regime requiring that manufacturer to report one.
Corporate Information With No Data Subject
Manufacturing process data at 25-1204, litigation strategy at 25-0916, engineering documentation in a compromised document store at 25-0719. None of it concerns an identifiable individual, so none of it triggers anything.
An organisation can lose the accumulated knowledge that constitutes its competitive position and have no disclosure obligation whatsoever. On every register this corpus surveys, that incident did not happen.
The Parties Who Cannot Pay
Regulation assigns duties to organisations. The corpus records repeatedly that the party best placed to fix a problem frequently cannot fund the fix — water districts at 26-0729, small clinics, forty-partner law firms at 25-0910, county governments at 25-0918.
An obligation without capacity produces non-compliance, not security. No instrument in this corpus pairs a duty with a funding mechanism.
And The Thing Regulation Cannot Reach At All
A rule can require controls, reporting and testing. It cannot make a help-desk conversation resistant to a plausible caller at 25-0512, cannot give a language model a boundary between instruction and data at 25-0224, and cannot make a patched server stop serving an attacker holding stolen keys at 25-0723.
That is not an argument against regulating. It is the reason the corpus files regulation as one mechanism among several rather than as the answer — and the reason a "compliant" organisation appears in this database as often as a non-compliant one.
It reads the 2025 regulatory files in this database against its incident record. Coverage assessments are this desk’s reading of published instruments, not legal advice, and scope questions turn on details we cannot resolve from drafts. Corrections: corrections@forensicpost.com.