Which Regulation Applies?

About this interactive

As attacks have grown, governments and industries have stopped leaving security to each business's budget. Laws, regulations and industry standards now set requirements an organization has to meet, and which ones apply is decided by two things: where its customers and their data are, and what sector it is in. GDPR is the European Union's data protection regulation. It follows the people: a company in the EU must follow it, and so must a company anywhere else that offers goods or services to people in the EU or monitors what they do there. A US business with customers in Germany is under GDPR. HIPAA is a US law for the healthcare sector. Hospitals, doctors, dentists, pharmacies and health insurers must protect patients' health information, and so must companies that handle that information for them. PCI DSS covers payment card data. It is not a law but an industry standard, set by the card brands and enforced through the contracts merchants sign to take cards. A coffee shop, a charity or a taxi company that takes cards must meet it. Real organizations often fall under more than one. Each card names one situation; drop it on the rulebook that situation brings in.

What you'll learn

Determine which regulation or standard an organization's situation brings in: GDPR for the personal data of people in the EU, HIPAA for US healthcare information, PCI DSS for payment card data
Recognize that obligations follow where customers and data are and which sector an organization is in, not only where the organization is based

Aligned to

CompTIA Security+

5.4 Summarize elements of effective security compliance.

5.1 Summarize elements of effective security governance.

Key terms

Compliance: The act of adhering to the laws, regulations, standards, and internal policies that govern how an organization handles data and security. Compliance programs use audits and controls to demonstrate that requirements are being met.
General Data Protection Regulation: A European Union regulation that establishes comprehensive data protection and privacy rights for individuals within the EU and EEA, and imposes obligations on organizations that process EU residents' personal data regardless of where the organization is located. GDPR introduced concepts such as data minimization, the right to erasure, and mandatory breach notification.
Health Insurance Portability and Accountability Act: A U.S. federal law that establishes national standards for protecting the privacy and security of patients' health information, known as Protected Health Information (PHI). HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic PHI.
Payment Card Industry Data Security Standard: A set of security requirements mandated by major credit card brands that organizations must follow to process, store, or transmit cardholder data. PCI DSS covers controls such as encryption, access restriction, and regular security testing.
Regulatory Compliance: The adherence to laws, government regulations, and industry standards that mandate how an organization must protect data and systems. Failure to meet regulatory requirements can result in fines, legal liability, and reputational damage.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →