Every industry has a rulebook. This module gives you the mental map of the major ones — what they protect, who enforces them, how they interconnect, and what happens when organizations ignore them.
Three forces create compliance regulations: (1) Market failures — companies won't voluntarily invest in privacy or safety if competitors don't. Regulation levels the playing field. (2) Information asymmetry — consumers cannot evaluate a company's security practices, so regulators require minimum standards. (3) Catastrophic harm — some harms (health data breach, financial fraud) are severe enough that society decides minimum floors are non-negotiable.
| Regulation | Protects | Who Must Comply | Max Penalty |
|---|---|---|---|
| GDPR | EU personal data | Any org processing EU residents' data | €20M or 4% global revenue |
| HIPAA | US health information (PHI) | Healthcare providers, insurers, business associates | $1.9M per violation category/year |
| PCI-DSS | Payment card data | Any org storing, processing, or transmitting card data | $5,000–$100,000/month; card acceptance revoked |
| SOX | Financial reporting integrity | US public companies | $5M fine; 20 years prison for executives |
A critical distinction: compliance is a minimum floor, not a ceiling. An organization can be 100% compliant and still be breached. The goal of compliance is to demonstrate minimum due care to regulators. The goal of security is to actually protect assets. The best programs pursue both — using compliance as the baseline and risk management to go further.
Enacted in 2018, GDPR is the most comprehensive data privacy law in the world. Its reach extends globally to any organization processing EU residents' personal data.
Lawfulness, Fairness, Transparency — processing must have a legal basis; Purpose Limitation — data collected for one purpose cannot be reused for another; Data Minimisation — collect only what is necessary; Accuracy — keep data correct and up to date; Storage Limitation — do not retain longer than needed; Integrity & Confidentiality — protect data; Accountability — be able to demonstrate compliance.
GDPR grants data subjects: Right of Access, Right to Rectification, Right to Erasure ("Right to be Forgotten"), Right to Data Portability, Right to Object, Rights related to Automated Decision-Making. GRC programs must build processes to honor these rights within statutory timeframes (30 days).
Six lawful bases: Consent, Contract, Legal Obligation, Vital Interests, Public Task, Legitimate Interests. Marketing commonly uses Consent; payroll uses Contract; security monitoring may use Legitimate Interests. The basis must be documented before processing begins.
Personal data breaches must be reported to the supervisory authority within 72 hours. Breaches posing high risk to individuals must also be communicated to those individuals without undue delay. GRC teams maintain breach notification procedures as part of incident response plans.
HIPAA (1996, updated through HITECH 2009) protects Protected Health Information (PHI) — any individually identifiable health information. GRC professionals must understand its three rules:
Governs how PHI can be used and disclosed. Patients have rights to access their records, request corrections, and receive notice of privacy practices. Minimum Necessary principle — only access the PHI required for the task.
Applies to Electronic PHI (ePHI). Requires Administrative Safeguards (policies, training), Physical Safeguards (facility access controls), and Technical Safeguards (encryption, access controls, audit logs). Risk analysis is explicitly mandated.
Covered entities must notify affected individuals within 60 days of discovering a breach. Breaches affecting 500+ individuals must be reported to HHS and media. All breaches logged in the Breach Log.
Any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a Business Associate and must sign a BAA. This is third-party risk management in practice — HIPAA extends to your entire supply chain.
HIPAA does not specify exact controls — it requires organizations to conduct a risk analysis and implement reasonable and appropriate safeguards. This makes HIPAA a principles-based regulation, unlike PCI-DSS which is prescriptive.
PCI-DSS v4.0 is a prescriptive, industry-driven standard developed by Visa, Mastercard, Amex, Discover, and JCB. It has 12 requirements organized into 6 goals:
| Goal | Requirements | Focus Area |
|---|---|---|
| Build & Maintain Secure Networks | 1–2 | Firewalls, no vendor defaults |
| Protect Cardholder Data | 3–4 | Encryption at rest and in transit |
| Vulnerability Management | 5–6 | Anti-malware, secure development |
| Strong Access Control | 7–9 | Least privilege, MFA, physical access |
| Monitor & Test Networks | 10–11 | Logging, intrusion detection, pen testing |
| Information Security Policy | 12 | Policies, training, vendor management |
PCI-DSS v4.0 introduced "Customized Approach" — organizations can implement controls differently if they can demonstrate equivalent security outcomes, acknowledging that prescriptive rules may not fit all environments.
SOX was enacted after the Enron and WorldCom collapses. It mandates internal controls over financial reporting (ICFR) and personal accountability for executives. Key GRC-relevant sections:
CEOs and CFOs must personally certify the accuracy of financial reports. False certifications carry criminal penalties up to 20 years imprisonment. This creates a direct personal accountability chain from IT controls to the C-suite.
Management must assess and report on the effectiveness of internal controls over financial reporting (ICFR). External auditors must attest to this assessment. Most GRC work in public companies ties back to Section 404 requirements.
Material changes to financial condition must be disclosed promptly. A major cyber incident affecting financial systems may trigger Section 409 disclosure obligations.
SOX auditors focus heavily on ITGCs: change management, access controls, computer operations, and data backup/recovery. Weak ITGCs undermine the reliability of financial reporting controls built on them.
Understanding this distinction shapes how you build compliance programs:
| Attribute | Prescriptive (e.g., PCI-DSS) | Principles-Based (e.g., HIPAA, GDPR) |
|---|---|---|
| Specificity | Tells you exactly what to do ("Requirement 1.1: Install firewall at each Internet connection") | Tells you the outcome required ("Implement reasonable safeguards") |
| Flexibility | Low — controls are specified; deviations require documented compensating controls | High — organizations choose how to achieve the required outcome |
| Auditability | Easy to audit — requirement met or not met | Requires judgment — is the approach "reasonable"? |
| Risk for orgs | Compliance theater — tick boxes but miss the spirit | Judgment risk — regulators may disagree on what is "reasonable" |
| Best approach | Implement prescribed controls + document rationale for any alternatives | Conduct thorough risk assessment; document all decisions and reasoning |
An effective compliance program is not just a policy document. The US Department of Justice and Federal Sentencing Guidelines define an effective compliance program as having eight elements:
Written policies that clearly communicate expected behavior and compliance requirements.
A designated compliance officer or committee with adequate authority and resources.
Background screening and vetting for individuals given compliance-sensitive roles.
All employees trained on relevant compliance obligations; training documented.
Regular testing to verify the program works. Audit findings feed continuous improvement.
Consistent consequences for violations. Without enforcement, policies are theater.
When violations occur, the organization responds appropriately, remediates, and prevents recurrence.
Ongoing assessment of compliance risks — identifying where the program is most likely to fail.
Check each item to confirm you understand which compliance framework it satisfies. This mirrors the daily work of a GRC analyst mapping controls to GDPR, HIPAA, PCI-DSS, and ISO 27001 simultaneously.