GDPR vs HIPAA: which to pursue first, and whether to do both
A health or life sciences organization holding EU patient data and US protected health information usually cannot choose only one of these laws. The GDPR governs all personal data of people in the EU, whatever the sector, while the HIPAA Security Rule governs electronic protected health information held by covered entities and business associates. Neither produces a certificate. HHS states that no Security Rule standard requires certification, and the GDPR requires no audit, attestation or certificate, with Article 42 certification voluntary and not reducing responsibility for compliance. What you have to show is evidence that your controls work, and that evidence is what regulators will ask for.
The order of work should follow two questions: which data sets you hold, and which regulator would examine you first. If EU patients are treated in or data flows from EU establishments, the GDPR applies to that processing and its breach clock and fines are the first exposure to test. If US ePHI sits with a covered entity or business associate, the Security Rule and OCR enforcement apply to the same systems. Confirm with counsel where each data set falls, and map every system to one or both regimes before choosing a sequence. A practical start is a single inventory of systems, data categories and contracts, then a gap review against the GDPR's Article 32 security duties and the Security Rule's required and addressable specifications.
Most programs run as one control set with two evidence views. The Security Rule's documentation duty, which requires retention for 6 years under 45 CFR 164.316(b)(2)(i), and the GDPR's accountability records can share one policy library, risk assessment and incident process, provided each regime's specific deadlines are tested separately. Ask your advisers to confirm which Security Rule revision is pending before you lock in documentation design, since HHS proposed a major revision in January 2025 that has not been finalized. For implementation support, DeployOpen can plan, document and test one shared control set for the client's own infrastructure, with the written scope agreed before work starts.
How GDPR and HIPAA compare on scope, deadlines and penalties
This table sets the GDPR and the HIPAA Security Rule side by side on who is bound, breach clocks, contract requirements, security measures, record retention and fines. Read each row as a question to put to your legal and compliance teams, since the two regimes overlap on some duties and diverge on others.
| Requirement | GDPR (EU) | HIPAA Security Rule (US) |
|---|---|---|
| Who is bound | Controllers and processors handling personal data of people in the EU, under Regulation (EU) 2016/679 (GDPR), applying across Member States and in Iceland, Liechtenstein and Norway. | Covered entities (health plans, clearinghouses, covered providers) and business associates, for electronic protected health information under 45 CFR 164.302. |
| Data covered | All personal data of identifiable people, with special category data (including health data) subject to stricter conditions. | Electronic protected health information held or transmitted by covered entities and business associates. Paper and oral PHI fall under other HIPAA rules, not this Security Rule. |
| Breach notice deadline | Notify the supervisory authority within 72 hours of becoming aware of a notifiable breach (Article 33(1)). | Business associates notify affected covered entities without unreasonable delay and within 60 calendar days of discovery (OCR, MMG Fusion press release, March 5, 2026). Confirm the individual and HHS clocks with counsel. |
| Processor or business associate contract | Processing by a processor must be governed by a binding written contract or other legal act, including electronic form (Article 28(3) and (9)). | A business associate may handle ePHI only after satisfactory assurances documented in a written contract or other arrangement (45 CFR 164.308(b)(1) and (b)(3)). |
| Security measures | Measures appropriate to the risk, considering the state of the art and implementation costs, naming pseudonymisation, encryption, resilience and regular testing (Article 32(1)). | Appendix A to Subpart C lists 18 standards and 36 implementation specifications, 14 required and 22 addressable, with documented reasoning for any addressable item not implemented (45 CFR 164.306(d)). |
| Documentation retention | No fixed retention period set in the regulation's core duties. Records of processing and accountability evidence must be kept available to supervisors on request (Articles 5 and 30). Confirm local retention rules with counsel. | Security Rule documentation must be kept for 6 years (45 CFR 164.316(b)(2)(i)), which adds ongoing storage and maintenance effort. |
| Penalty structure | Article 83 maximums of EUR 10 million or 2% of worldwide annual turnover for tier-one infringements, and EUR 20 million or 4% for tier-two, whichever is higher. | Inflation-adjusted civil money penalties per violation, from $145 (no knowledge) to $2,190,294 (uncorrected willful neglect), with a calendar-year cap of $2,190,294 (45 CFR 102.3, 91 FR 3666, for penalties assessed on or after January 28, 2026). |
| Certification or proof | No audit, attestation or certificate required. Article 42 certification is voluntary and does not reduce responsibility. | No HIPAA certification exists. HHS does not endorse private certifications (HHS FAQ 2003), so evidence is the documented risk analysis and controls. |
Which organizations does each law reach?
The GDPR reaches any controller or processor that handles personal data of people in the EU, and it also applies in Iceland, Liechtenstein and Norway under the EEA Joint Committee Decision that entered into force on 20 July 2018. Its reach follows the data subject's location and the processing activity, not the company's size or sector. A life sciences company with a trial site in Germany, a clinical data vendor in Ireland or a pharmacovigilance team that receives adverse event reports from patients in the EU is likely processing personal data in scope. The HIPAA Security Rule works differently. It applies to covered entities (health plans, health care clearinghouses and covered health care providers) and to business associates that create, receive, maintain or transmit electronic protected health information (ePHI) for them, under 45 CFR 164.302. A sponsor, research organization or software vendor that never touches ePHI for a covered entity may fall outside it entirely.
The practical result is that a life sciences company may be bound by one law, both or neither, and the answer can differ by data flow rather than by company. Map each dataset to its origin, its holder and its role: is the company acting as controller or processor for EU personal data, and does any US dataset contain ePHI created or received for a covered entity? Pay particular attention to datasets that move between the two sides, such as EU patient records transferred to a US analytics partner or US trial data shared back to an EU sponsor. Those flows can bring one law into play for data that the other law previously governed. Keep the map current, because a new vendor or research arrangement can change the answer without any change to the legal entity.
Confirm each conclusion with counsel before you rely on it, and ask them to state the basis in writing for each data flow. Counsel should also confirm whether any EU data is in scope for an Article 37 data protection officer, since that depends on core activities involving large-scale special category data. Keep the written scope analysis with your compliance records, because it determines which contracts, breach processes and security measures the rest of this comparison applies to.
Where the GDPR and HIPAA work overlaps
The GDPR and the HIPAA Security Rule both expect appropriate security, written contracts with processors or business associates, incident records and retained documentation. The overlap is real in process terms, but the legal tests, deadlines and proof differ, so each card names what to check on both sides.
Security of processing
GDPR Article 32(1) requires measures appropriate to the risk, taking account of the state of the art and implementation costs, and names pseudonymisation, encryption, ongoing confidentiality, integrity, availability and resilience, timely restoration and regular testing. The Security Rule's administrative, physical and technical safeguards cover much of the same ground, but its implementation specifications are required or addressable and apply only to ePHI. Map each control once, then check which records are ePHI and which are broader personal data.
Processor and business associate contracts
GDPR Article 28(3) requires processing by a processor to be governed by a binding written contract or other legal act, and electronic form is allowed. Under 45 CFR 164.308(b), a covered entity may let a business associate handle ePHI only after obtaining satisfactory assurances documented in a written contract or other arrangement. One vendor agreement can often cover both, but check that it names the GDPR instructions, the HIPAA assurances and each party's breach duties.
Breach documentation and records
Both regimes expect you to record what happened, what was affected and what you did about it, even when a notice is not required. Business associates must notify covered entities of a breach without unreasonable delay and within 60 calendar days of discovery. Keep one incident record that holds the facts needed for the GDPR supervisory authority notice and the HIPAA analysis, so each clock can be checked from the same source.
Risk assessment and testing
GDPR Article 32 ties security measures to risk and requires regular testing of their effectiveness, and Article 35 covers impact assessments for high-risk processing. The Security Rule requires an accurate and thorough risk analysis of ePHI, and NIST SP 800-66 Rev. 2 (February 2024) gives key activities and sample questions for implementing it. The NIST guide is informational, not legally binding, so it helps structure your evidence without replacing the legal test.
Documentation retention
The Security Rule requires documentation of policies, procedures and actions to be kept for 6 years, which adds ongoing storage and maintenance work. The GDPR requires controllers to keep records of processing and to demonstrate compliance, but it does not set a single six-year period in the supplied facts. Confirm your retention schedule against both rules, and set the longer period for records that fall under both.
Mapping does not prove equivalence
Cross-framework mappings help teams reuse evidence, but they do not establish that one rule satisfies the other. ENISA states that its mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation's requirements. Use mappings to plan shared controls, then ask counsel and your privacy team to confirm which gaps, such as lawful basis and data subject rights, remain open.
Who assesses each framework and what it produces
This table compares who checks compliance under the GDPR and the HIPAA Security Rule and what each produces as evidence. Read it to see which side offers a certificate, which offers voluntary certification and which relies on regulator enforcement without any certificate.
| Question | GDPR | HIPAA Security Rule |
|---|---|---|
| Is there a required audit, attestation or certificate? | No. The GDPR requires no audit, attestation or certificate. | No. HHS states no Security Rule standard requires an entity to certify compliance. |
| Is there a voluntary certification route? | Yes. Article 42 certification is voluntary, issued for at most three years by accredited certification bodies or supervisory authorities. | No HIPAA certification exists. HHS does not endorse or recognize private certifications, and they do not prevent a later violation finding. |
| Does certification reduce legal responsibility? | No. Article 42 certification does not reduce the controller's or processor's responsibility for compliance. | Not applicable. Private certifications carry no legal shield against an HHS finding. |
| Who enforces the rules? | Independent national supervisory authorities (Article 51), with the EDPB resolving disputes through binding decisions. | HHS Office for Civil Rics (OCR), through complaint investigations, compliance reviews and audits. |
| What did recent audits cover? | Not applicable. Enforcement is by supervisory authorities, not a periodic audit program. | OCR's 2024 to 2025 HIPAA audits reviewed 50 covered entities' and business associates' compliance with provisions most relevant to hacking and ransomware. |
| Is the security rule being revised? | The GDPR text has not been amended as of October 2026. Confirm any change through the Legislative Observatory procedures, which concern Omnibus IV and the Digital Omnibus. | HHS proposed a major Security Rule revision on January 6, 2025 (90 FR 898). As of October 2026 no final rule exists, and the latest Unified Agenda projects final action for July 2027. Confirm the date before planning around it. |
| What evidence should you keep? | Records of processing, risk assessments, policies and proof of controls, since regulators will ask for them directly. | Security Rule documentation kept for 6 years (45 CFR 164.316(b)(2)(i)), plus evidence that addressable specifications were assessed and documented. |
Running breach notice and contract terms under both laws
Under the GDPR, the controller must notify the competent supervisory authority within 72 hours of becoming aware of a notifiable personal data breach (Article 33(1)). The clock starts at awareness, not at the moment the incident began, so intake and escalation must move fast enough for the controller to decide within that window. Article 33 also requires the controller to document each personal data breach, including its facts, effects and remedial action, whether or not it is reported to the authority. A readiness review should test whether that record exists for past incidents and whether the team can produce it quickly.
- Awareness trigger: Define who can declare awareness and how that moment is logged, since the 72 hours run from it.
- Staged notification: Confirm with counsel whether an initial notice can be filed and completed later, and who approves it.
- Internal breach register: Keep documentation for every breach, including incidents that were never reported.
- Data subject communication: Article 34 governs notice to individuals. Confirm with counsel which conditions trigger it.
- Processor timing: Processors must notify the controller without undue delay (Article 33(2)), so processor contracts must allow time for the 72-hour window.
Confirm with counsel how member state rules and any other incident reporting duties interact with this clock before you finalize the incident runbook.
A business associate must notify affected covered entities of a breach without unreasonable delay and within 60 calendar days of discovery, as OCR described in its March 5, 2026 announcement on the MMG Fusion matter. Sixty days is the outer limit, so a contract that waits for the full period can leave the covered entity with little time to meet its own obligations. The clock runs from discovery, which makes the definition of discovery in the contract a practical question rather than a legal formality. The covered entity's individual and HHS notice duties sit outside this clock and must be confirmed with counsel.
- Discovery definition: Write down when the business associate is treated as having discovered an incident, since the 60 calendar days run from that date.
- Notice content: Agree in advance what the business associate sends the covered entity, in what format, and to whom.
- Covered entity duties: Confirm with counsel the individual and HHS notice rules that apply to your organization, because they are not set out on this page.
- Subcontractor chain: Confirm how a subcontractor's incident reaches the business associate and then the covered entity, and how quickly.
- Dual-law incidents: One incident involving EU and US data can start a 72-hour supervisory authority clock and a 60-day business associate clock at the same time.
Test a tabletop exercise against both clocks, using a scenario that involves a business associate and an EU data subject.
Article 28(3) requires that processing by a processor be governed by a contract or other legal act that is binding on the processor and in writing, and Article 28(9) allows that writing to be in electronic form. HIPAA takes a different route. A covered entity may let a business associate create, receive, maintain or transmit ePHI only after obtaining satisfactory assurances, documented in a written contract or other arrangement (45 CFR 164.308(b)(1) and (b)(3)). The GDPR contract is a list of required content, while the HIPAA standard turns on documented assurances that the rule defines. Confirm the required terms under each framework with counsel before drafting.
- GDPR processor terms: Article 28(3) expects the contract to cover subject matter, duration, nature and purpose, data types, data subject categories and the controller's obligations and rights.
- HIPAA assurances: The business associate arrangement must exist before any ePHI flows to the vendor, and it must be documented.
- Subprocessors: Both regimes reach downstream parties, so confirm in writing how terms flow down to each subcontractor.
- Evidence rights: Ask for clauses that let you verify processor security and obtain evidence after an incident. Confirm enforceability with counsel.
- Combined addendum: A single addendum can cover both laws, but check each required element separately, because satisfying one framework's list does not satisfy the other.
Before any personal data or ePHI moves to a vendor, confirm the signed contract includes breach clauses that match the 72-hour and 60-day clocks.
How penalties differ and what moves an organization between tiers
The GDPR sets two turnover-based ceilings in Article 83, while HIPAA sets per-violation amounts with an annual cap. Under Article 83, infringements such as those of Articles 25 to 39 carry a maximum of EUR 10 million or 2% of total worldwide annual turnover, and infringements of the principles, lawful basis, data subject rights and transfer rules carry a maximum of EUR 20 million or 4%, in each case whichever is higher. For HIPAA, the inflation-adjusted civil money penalty for penalties assessed on or after January 28, 2026 ranges from $145 per violation where the entity did not know of the violation up to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 under 45 CFR 102.3. A multinational health organization should model both regimes separately, because a single incident can produce exposure under each.
The tier an organization falls into depends on the infringement category and on culpability, not on the breach alone. Under the GDPR, a failure to secure processing under Article 32 sits in the lower tier, while a failure to respect lawful basis or data subject rights sits in the higher one, so the classification of each finding matters as much as its size. Under HIPAA, the culpability levels that drive the amount run from no knowledge to willful neglect, and the difference often turns on whether the entity identified and corrected the problem in time. Ask counsel to confirm how each regulator applies these categories to your processing and document the facts that show what the organization knew and when it acted.
The regulators also differ. GDPR fines are set by independent national supervisory authorities in each Member State, with the European Data Protection Board resolving disputes between them, so a cross-border case may involve several authorities. HIPAA penalties are assessed by the HHS Office for Civil Rights, which enforces the Security Rule through complaint investigations, compliance reviews and audits. Confirm with your EU lead authority and your HHS regional office how each would take up an incident, and keep the evidence trail for both in one place.
Sequencing one program for both frameworks
The sequence turns two separate legal regimes into one working program by settling scope and roles first, then building shared controls, then aligning the incident and contract processes that depend on both.
Map data flows and assign roles
Trace where EU personal data and US ePHI enter, move, are stored and are deleted, including every system, vendor and staff group that touches them. For each flow, record whether your organization acts as a controller, processor, covered entity or business associate, because that answer decides which obligations attach. The output is a data flow register with a named owner for each flow and role, reviewed by privacy, security and legal together. Confirm the role determinations with counsel, since the same entity can hold different roles for different datasets.
Confirm which law applies to each dataset
For each flow in the register, determine whether the GDPR, the HIPAA Security Rule or both apply, based on where the data subject is located, what the data is and who holds it. Mark datasets that fall under both laws, datasets under only one, and datasets whose status is unclear. The output is a signed applicability matrix that lists the legal basis for each call. Ask counsel to review edge cases such as research data, de-identified data and data held for EU patients by a US business associate, and record the regulator or guidance you relied on for each decision.
Build a shared control set
Start from the Article 32 security expectations and the HIPAA Security Rule standards, then write one control set that covers both, with the stricter requirement winning where they overlap. Record each control's owner, its evidence and the regulation sections it serves. Where a HIPAA addressable specification is handled by an alternative measure, document the reasoning, since the same logic supports the GDPR's risk-based approach. The output is a control catalog that maps each control to both legal sources. Testing it against the regulators' own guidance, such as NIST SP 800-66 Rev. 2 for HIPAA, helps show the mapping is sound.
Assemble the shared documentation library
Collect policies, risk assessments, records of processing, data flow diagrams, training records and vendor files into one library with a single version history. Tag each document with the GDPR article or HIPAA section it supports. Set retention so that HIPAA Security Rule documentation is kept for the required six years and GDPR records meet the controller's own schedule. The output is an indexed library in which an auditor or regulator can locate evidence for either framework without duplicate copies. Ask counsel which records must be produced to which authority and in what format.
Align processor and business associate contracts
Review every processor and business associate agreement against the GDPR Article 28 requirements and the HIPAA satisfactory assurance rules at 45 CFR 164.308(b). Where one vendor serves both populations, decide whether a single contract can meet both sets of terms or whether two instruments are needed. Confirm that each contract is in writing and binding, and that breach notification terms match the clocks you plan to run. The output is a contract register showing which terms each vendor has accepted. Have counsel confirm the final wording before signature.
Build one incident response process for both clocks
Write a single incident procedure that classifies each event by the data it touches, then branches into the GDPR notification to the supervisory authority within 72 hours of awareness where a notifiable breach exists, and the HIPAA notification steps for covered entities and business associates. Include who decides on individual notices under each law, who speaks to regulators and how the timeline is recorded. The output is a tested runbook with contact lists for each regulator and a documented decision log. Run a tabletop exercise against both clocks and confirm the escalation path with counsel and the relevant regulators' published guidance.
Test the program and confirm open questions
Walk each dataset through its control set, documentation and incident runbook to check that the evidence exists and the owners can produce it. Record gaps, assign them to owners and retest them before the program is treated as in place. List questions that depend on facts you cannot settle internally, such as cross-border transfer mechanisms, pending HHS rulemaking and any EU legislative changes, and assign each to counsel or the regulator. The output is a gap log and an open-questions register that is reviewed on a set schedule. Keep a record of what was tested, by whom and against which version of the control set.
What do buyers ask before hiring help for GDPR and HIPAA?
Does a certificate prove GDPR or HIPAA compliance?
No. The GDPR requires no audit, attestation or certificate. Article 42 certification is voluntary, lasts for at most three years, and does not reduce the controller's or processor's responsibility. For HIPAA, HHS states that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognize private certifications, and that such certifications do not prevent HHS from later finding a violation. Any vendor or consultant offering a HIPAA certificate should be asked to explain what it covers and what it does not. The proof that matters for both laws is documented evidence that your controls work, which is what a readiness engagement prepares.
What drives the cost of GDPR and HIPAA work?
Cost follows scope. The main drivers are the number of data flows that touch EU personal data or ePHI, the number of processors and business associates that need contracts reviewed, how much current documentation already exists, and how mature your incident process is. Fewer flows, existing Security Rule documentation and a tested incident runbook shorten the work. One-time items include the gap assessment, control design, contract remediation and runbook build. Recurring items include policy reviews, evidence collection, and retainers for upgrades and testing. Ask any provider to price these as separate line items in a written quote.
How long does GDPR and HIPAA readiness work take?
The duration depends on the scope you agree, so no timeline is given here. Ask for a schedule with milestones in the written scope, including which deliverables depend on your system owners, legal reviewers and log access. Some dates are fixed by law and should be tested early in any readiness review, such as the 72-hour supervisory authority notice under GDPR Article 33(1) and the 60-day business associate notice to covered entities. Work on those clocks often sets the critical path. Confirm with each provider how they handle delays caused by client-side reviews.
What does my team need to provide during an engagement?
Expect to supply named system owners who can describe data flows and access paths, legal review of processor and business associate contracts, and read access to logs, identity records and backup configurations. Security Rule documentation must be kept for six years under 45 CFR 164.316(b)(2)(i), so your team also needs to agree who maintains those records after handover. Ask the provider to list every client-side input in the scope, with an owner and a date, so delays are visible early.
Can an internal team handle GDPR and HIPAA work alone?
Some organizations can, particularly where legal, security and privacy staff already work together and documentation is current. The GDPR Article 37 duty to appoint a data protection officer applies only in specific cases, so check whether it applies to you. HIPAA's addressable specifications require a documented risk assessment of each choice, which takes sustained attention. Be honest about capacity: an internal team needs time for control testing, contract updates and incident exercises. An outside partner can supply the independent view, test the controls and prepare the evidence, while your staff keep decision rights.
What should a fixed-scope quote for GDPR or HIPAA include?
A fixed-scope quote should start from a written scope that names the laws covered, the systems, data stores, processors and business associates in scope, and the deliverables. Ask for each deliverable to be described in plain terms, with acceptance criteria, the client inputs it depends on, and what is excluded. Ask whether ongoing support, upgrades and testing are priced separately as a retainer. DeployOpen works from a written scope and does not publish a price list, so a quote follows from the scope agreed with you. Ask any provider to confirm this in writing before work starts.
Which part of the work is hardest to get right?
Most teams find that the contracts and the incident process take the longest. Under GDPR Article 28, processor contracts must be binding and in writing, while 45 CFR 164.308(b) requires satisfactory assurances from each business associate before ePHI is shared. A single incident process must also meet the GDPR 72-hour clock and the HIPAA 60-day individual notice clock. Ask the provider how they will test the process with a tabletop exercise, who signs off on each notice, and how contract gaps will be tracked to closure.
How DeployOpen scopes and delivers GDPR and HIPAA readiness
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems and evidence for GDPR and HIPAA readiness. We do not issue audit reports, attestations or certifications, because neither law has a certificate that a vendor can grant.
How we scope
- Written scope lists which personal data and ePHI flows, systems and processors fall under each law.
- Scope names the Article 33 and 45 CFR 164.410 notification paths so both clocks are designed in from the start.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We configure controls against GDPR Article 32 and Security Rule safeguards, mapping each to a named system.
- Processor and business associate contract templates are reviewed against your existing agreements before use.
- Security testing of applications, APIs and infrastructure checks that the controls work as documented.
How we hand over
- Documentation covers policies, risk analysis records and the six-year retention approach for HIPAA documentation.
- Runbooks cover breach response steps, rights request handling and where each evidence artifact lives.
- Your team receives the evidence set, with a list of gaps you must confirm with counsel or an assessor.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainer scope is agreed in writing and can cover changes to either law, such as a final HIPAA Security Rule.
- Ask for a quote built from your written scope, since DeployOpen does not publish a price list.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR), EUR-Lex ↗
- 45 CFR Part 164 Subpart C, Security Standards for the Protection of Electronic Protected Health Information, eCFR ↗
- 45 CFR 164.308(b), eCFR ↗
- HHS FAQ 2003: Are we required to certify our organization's compliance with the standards? ↗
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide ↗
