Compliance Frameworks: PCI-DSS, HIPAA, GDPR & SOC 2

Why "Compliant" Isn't the Same as "Secure"

Compliance frameworks set a minimum bar defined by a regulator, card network, or customer contract — not a ceiling. An organization can be fully PCI-DSS compliant and still get breached. Treat compliance as a floor, and use the previous lesson's ALE-driven prioritization to decide where to go beyond it.

PCI-DSS — Payment Card Industry Data Security Standard

Applies to anyone who stores, processes, or transmits cardholder data — not a law, but a contractual requirement from card networks (Visa, Mastercard, etc.).

Core idea: scope reduction. The smaller your Cardholder Data Environment (CDE), the less you need to secure and audit.

Validation level depends on transaction volume: Level 1 merchants (>6M transactions/yr) need an annual on-site audit by a Qualified Security Assessor (QSA); smaller merchants can typically self-assess (SAQ).

HIPAA — Health Insurance Portability and Accountability Act

US federal law protecting PHI (Protected Health Information) — any individually identifiable health information.

• Privacy Rule — governs use and disclosure of PHI (who can see it, minimum necessary standard)
• Security Rule — governs electronic PHI (ePHI): administrative, physical, and technical safeguards
• Breach Notification Rule — notify affected individuals within 60 days of discovery; notify HHS; notify media if >500 individuals in a state are affected

A Business Associate Agreement (BAA) is required with any third party that touches PHI on your behalf (e.g. a cloud host) — the HIPAA equivalent of PCI's "processes cardholder data" scoping trigger.

GDPR — General Data Protection Regulation

EU regulation protecting personal data of EU residents, regardless of where the processing company is based.

Data Subject Rights

Breach Notification

Controllers must notify the relevant supervisory authority within 72 hours of becoming aware of a breach likely to risk individuals' rights — far tighter than HIPAA's 60 days.

Penalties

Up to €20M or 4% of global annual revenue, whichever is higher — deliberately scaled to be painful even for large multinationals.

SOC 2 — System and Organization Controls

Unlike PCI-DSS or HIPAA, SOC 2 isn't a checklist of prescribed controls — it's an independent auditor's opinion on whether your own controls meet the five Trust Services Criteria:

• Type I — controls are suitably designed at a point in time
• Type II — controls actually operated effectively over a period (typically 6-12 months) — this is what most enterprise customers require before signing, because it proves controls work in practice, not just on paper.

Choosing the Right Framework

Frameworks stack — a US healthcare SaaS company billing by card and serving EU patients could be in scope for all four at once.

Common Pitfalls

• Assuming a data processing agreement with a vendor transfers your compliance obligation — it doesn't; you remain accountable for your data
• Missing GDPR's tighter 72-hour breach window because incident response runbooks were only built around HIPAA's 60-day window
• Confusing SOC 2 "Security" (the only mandatory criterion) with "we must cover all five criteria" — most companies scope to Security + Availability initially