GDPR, HIPAA, PCI-DSS: Cybersecurity Compliance Frameworks Explained

cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication) compliance frameworks are sets of rules, standards, and controls that organisations must follow to protect data, privacy, and systems. Some are government regulations with legal penalties; others are voluntary standards that demonstrate security maturity.

Understanding which frameworks apply to your organisation — and what they require — is fundamental to enterprise cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication).

GDPR — General Data Protection Regulation

Who it applies to: Any organisation that processes personal data of individuals in the EU/EEA — regardless of where the organisation is based. A US company with EU customers is subject to GDPR.

What it protects: Personal data (any information relating to an identifiable natural person).

Key Requirements

Lawful basis for processing: Data must be collected with a valid legal basis — consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Individual rights:

• Right of access — individuals can request a copy of their data
• Right to erasure ("right to be forgotten") — individuals can request deletion of their data
• Right to portability — individuals can receive their data in a machine-readable format
• Right to object — individuals can object to processing for direct marketing

Data minimisation: Collect only the data you need; retain it only as long as necessary.

Privacy by design: Security controls must be built into systems from the start, not added later.

Data breach notification: Report breaches to the supervisory authority within 72 hours; notify affected individuals "without undue delay" if there is high risk.

Data Protection Officer (DPO): Required for public authorities and organisations that process data at scale.

Penalties

Up to €20 million or 4% of global annual turnover (whichever is higher) for serious violations. Lower tier: up to €10M or 2% for less severe breaches.

Key Roles

• Data Controller: Determines the purpose and means of processing (e.g. the business collecting data)
• Data Processor: Processes data on behalf of the controller (e.g. a cloud provider, SaaS tool)

HIPAA — Health Insurance Portability and Accountability Act

Who it applies to: US healthcare organisations — covered entities (hospitals, clinics, insurers) and their business associates (cloud providers, billing services, IT vendors handling health data).

What it protects: Protected Health Information (PHI) — any information about health status, treatment, or payment linked to an individual.

Key Rules

Privacy Rule: Defines when PHI can be used or disclosed. Patients have rights to access and correct their records.

Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI (ePHI):

• Administrative: Risk assessments, workforce training, incident response-security-operations-centre-SIEM-incident-response-explained) plans
• Physical: Facility access controls, workstation security, device disposal
• Technical: Access controls, audit logs, encryption, automatic logoff

Breach Notification Rule: Notify affected individuals within 60 days of a breach; report large breaches (500+ individuals) to HHS and media.

Minimum Necessary Standard: Only use or disclose the minimum amount of PHI needed for the purpose.

Penalties

Tiered civil penalties from $100 to $50,000 per violation, up to $1.9 million per category per year. Criminal penalties: up to 10 years in prison for wilful violations with intent to sell data.

PCI-DSS — Payment Card Industry Data Security Standard

Who it applies to: Any organisation that stores, processes, or transmits cardholder data (credit/debit card numbers, CVVs, expiry dates). Set by the major card brands (Visa, Mastercard, Amex).

What it protects: Cardholder data and the systems that handle it.

The 12 PCI-DSS Requirements

| # | Requirement | |---|---| | 1 | Install and maintain [Network Security)](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) controls (firewalls) | | 2 | Apply secure configurations to all system components | | 3 | Protect stored account data (encryption, tokenisation) | | 4 | Protect cardholder data in transit with strong cryptography-symmetric-vs-asymmetric) | | 5 | Protect all systems from malware | | 6 | Develop and maintain secure systems and applications | | 7 | Restrict access to system components by business need | | 8 | Identify users and authenticate access | | 9 | Restrict physical access to cardholder data | | 10 | Log and monitor all access to system components | | 11 | Test security of systems and networks regularly | | 12 | Support information security with organisational policies |

Compliance Levels

• Level 1: 6M+ transactions/year — annual on-site audit by a Qualified Security Assessor (QSA)
• Levels 2–4: Quarterly vulnerability scans, annual Self-Assessment Questionnaire (SAQ)

Non-compliance can result in fines from card brands ($5,000–$100,000/month), increased transaction fees, or loss of the ability to accept card payments.

ISO 27001 — International Standard for Information Security

Who it applies to: Any organisation, any sector, any size. Voluntary international standard.

What it is: A framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) — a systematic approach to managing sensitive information.

Key Elements

Context of the organisation: Define internal and external issues, interested parties, and the ISMS scope.

Risk assessment and treatment: Identify information security risks, assess their likelihood and impact, and select appropriate controls.

Annex A controls: 93 controls across 4 themes:

• Organisational controls (policies, roles, supplier relationships)
• People controls (screening, training, disciplinary process)
• Physical controls (secure areas, equipment)
• Technological controls (access control, encryption, monitoring, incident management)

Continual improvement: Regular internal audits, management reviews, and corrective actions.

Certification: A UKAS-accredited certification body audits the ISMS and issues a certificate-certificates-and-PKI-explained) valid for 3 years (with annual surveillance audits).

SOC 2 — Service Organisation Control 2

Who it applies to: SaaS companies, cloud providers, and data centres that store or process customer data. Common requirement from enterprise customers during vendor due diligence.

What it is: An audit framework created by the American Institute of CPAs (AICPA). A CPA firm audits the organisation's controls against the Trust Services Criteria:

• Security (required): Protection against unauthorised access
• Availability (optional): Systems are available as committed
• Processing Integrity (optional): Processing is complete, accurate, and authorised
• Confidentiality (optional): Designated confidential information is protected
• Privacy (optional): Personal information is collected, used, and retained appropriately

Type I: Point-in-time audit — confirms controls are designed correctly Type II: Period audit (6–12 months) — confirms controls operated effectively over time. Enterprise customers strongly prefer Type II.

Frameworks Comparison

| Framework | Type | Applies to | Enforcement | |---|---|---|---| | GDPR | Regulation | EU personal data | Government fines up to 4% revenue | | HIPAA | Regulation | US health data | HHS enforcement, criminal penalties | | PCI-DSS | Industry standard | Card payments globally | Card brand fines, payment suspension | | ISO 27001 | Standard | Any organisation | Voluntary; market/contract pressure | | SOC 2 | Audit framework | US cloud/SaaS | Voluntary; enterprise customer pressure |

The NIST Cybersecurity Framework (NIST CSF)

The NIST CSF is a US voluntary framework widely used alongside regulatory compliance. It organises security activities into five functions:

Identify → Protect → Detect → Respond → Recover

Many organisations align GDPR, HIPAA, or ISO 27001 controls to the NIST CSF to get a unified view of their security posture.

Key Takeaways

• GDPR protects EU citizens' personal data globally; fines reach 4% of global revenue
• HIPAA mandates administrative, physical, and technical safeguards for US healthcare data
• PCI-DSS protects payment card data; non-compliance can mean losing the ability to accept cards
• ISO 27001 is the international standard for an ISMS; certification demonstrates security maturity to customers
• SOC 2 Type II is the vendor security report most enterprise customers request
• Most frameworks overlap significantly — implementing one well accelerates compliance with others