Data compliance – everything you need to know

If you’re an organisation that handles data, then you need to be aware of the different data compliance regulations and standards. Data protection compliance is extremely important, as it helps protect the privacy of individuals who have entrusted their information to you. We’ll discuss everything you need to know about data compliance. We’ll go over what it is, the different regulations and standards, and how you can be compliant. Stay safe and protect your customers by ensuring your business is fully compliant with data privacy laws.

What is data compliance?

Data compliance is the process of ensuring that data is collected, stored, and processed in accordance with all applicable laws and regulations. Many data compliance requirements are related to data privacy, which is the protection of personal information. It is important to know what and how much data you are collecting, as well as where and for how long it will be stored. You should also have a plan for what will happen to the data if it is no longer needed or if the individual asks for it to be deleted.

Data compliance regulations and standards

There are a number of different data protection regulations and standards that organisations need to be aware.

• GDPR
• CCPA
• PIPEDA
• HIPAA
• PCI DSS
• SOX

GDPR

What is GDPR?
The General Data Protection Regulation (GDPR) is a set of regulations that member states of the European Union must implement in order to protect the privacy of individuals within the EU. The GDPR applies to any organisation that processes or intends to process the personal data of individuals in the EU, regardless of whether the organisation is based inside or outside of the EU.

The GDPR has strict rules for how personal data may be acquired, utilised, and protected. It also gives users the right to know what personal information is being collected about them, the right to have it deleted, and the right to object to its use.

Organisations that have failed to comply with the GDPR include Amazon, Google and Facebook. Amazon received a fine of over €700 million for the way it collects and shares personal data.

CCPA

The California Consumer Privacy Act (CCPA) is a law that was passed in 2018 in the state of California, USA. The CCPA applies to any for-profit organisation that does business in California and meets one or more of the following criteria:

• Has annual gross revenues in excess of $25 million;
• buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or
• derives 50 percent or more of its annual revenues from selling consumers’ personal information.

The CCPA gives Californian consumers the right to know what personal information is being collected about them, the right to have their personal data erased, and the right to opt out of its sale.

Organisations that fail to comply with the CCPA can be fined up to $7500 per violation.

PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a law that applies to organisations in Canada that collect, use, or disclose personal information in the course of commercial activities. PIPEDA does not apply to organisations that are subject to provincial privacy laws, such as those in Quebec and British Columbia. Charities and not-for-profit organisations are also exempt from PIPEDA.

Organisations that fail to comply with PIPEDA can be fined up to $100,000 per violation.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a law that applies to organisations in the United States that deal with protected health information (PHI). HIPAA sets out strict requirements for how PHI must be collected, used, and protected. The regulations also guarantee that consumers are informed about what data is being collected about them, the ability to have their personal information deleted, and the right to object to its usage.

Fines for HIPAA violations can range from $50,000 to $250,000 per violation, however restitution may also need to be paid to the victims.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that were created by the major credit card companies to protect cardholder data. PCI DSS applies to any organisation that stores, processes, or transmits credit card information.

Cardholder data cannot be stored unless it is encrypted. Encryption must be used for all transmissions of cardholder data over public networks.

Organisations that fail to comply with PCI DSS can be fined up to $100,000 per month until they achieve compliance.

SOX

The Sarbanes-Oxley Act (SOX) is a law that applies to publicly traded companies in the United States. SOX sets out strict requirements for how financial information must be collected, used, and protected. It protects investors from fraud by enforcing strict auditing and financial regulations.

Executives of organisations that fail to comply with SOX can be fined up to $1 million and face imprisonment.

How to be compliant?

There are a number of steps that organisations need to take in order to become data compliant. These steps include:

• Assessing what personal data you have and where it came from
• Establishing policies and procedures for how personal data will be collected, used, and protected
• Implementing technical and organisational measures to protect personal data
• Designating someone to be responsible for data compliance

Why is data compliance important?

Data compliance is important because it helps to protect the personal data of individuals. Organisations must decide whether they are a data controller or a data processor. Either way they have a responsibility to ensure that this data is protected. Data security compliance helps to ensure that organisations are meeting their responsibilities.

Organisations that fail to comply with data protection regulations can be fined, and their reputation may suffer. In some cases, individuals may also suffer damages if their personal data is mishandled. Data compliance is therefore important for organisations and individuals alike.

FAQs on data compliance