Comparisons anchored on the GDPR, the EU's data protection regulation: against HIPAA, ISO 27001 and PCI DSS. EU law pairings with NIS2, DORA and the EU AI Act sit under those anchors.
For health and life sciences organizations handling EU and US patient data: the GDPR covers all personal data of people in the EU, with fines of up to 4% of worldwide turnover, while the HIPAA Security Rule covers ePHI held by covered entities and business associates. Compares breach deadlines, processor and business associate contracts, security measures, documentation and penalties.
Whether an ISO/IEC 27001 certificate helps with the GDPR: the GDPR is law that demands appropriate security under Article 32 and demonstrable accountability, while ISO 27001 certifies an ISMS. Covers how GDPR Article 42 certification differs from an ISO certificate, what controllers ask processors to show, and the privacy duties an ISMS does not reach.
For merchants and payment providers in Europe: PCI DSS is a payment brand rulebook for account data validated by ROC or SAQ, while the GDPR is law for all personal data. Covers why encryption alone keeps card data in PCI scope, where the GDPR names encryption and pseudonymization, breach notice duties, who enforces each and what non-compliance costs.
For software and connected-product makers selling into the EU: the GDPR governs personal data processing by controllers and processors, the Cyber Resilience Act governs the security of products with digital elements placed on the market. Covers who each binds, CE marking and conformity assessment versus supervisory enforcement, the separate reporting channels, fines and which to plan for first.
For US companies with EU customers asking whether NIST CSF work satisfies the GDPR: one is binding EU law on personal data with fines, the other a voluntary NIST outcomes framework with no certification. Covers where CSF 2.0 outcomes support Article 32 security, what the GDPR requires that the CSF does not (lawful basis, rights, breach notification) and how to run both.
For health tech and life sciences companies holding both EU personal data and US PHI: how the GDPR 72-hour supervisory authority deadline compares with the HIPAA 60-day individual notice, the HHS reporting split at 500 individuals, business associate duties, and how to run one incident process that meets both clocks.
How fines compare for organizations exposed to both laws: GDPR turnover-based maximums in two tiers set by Article 83 against HIPAA civil money penalties per violation with annual caps, who enforces each, and what moves an organization between tiers, so leaders can weigh exposure on each side.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.