The short answer is no. Regulatory compliance signifies a set of requirements a business is obligated to follow depending on local, state, federal, or international laws. But not all compliance standards are mandated by law.
To save your business time and money, it’s important to know which compliance regulations are legal requirements and which ones are not. Below, we’ll explain some of the most common compliance standards so you can find out which ones are worth your attention. You’ll also find helpful guides and resources about each compliance framework along the way.
SOC 2 is likely the most common, sought-after compliance standard for internet businesses located in the US, yet it doesn’t fall under regulatory compliance. A SOC 2 report is often the primary document that’s used to assess a company’s security risk.
Although SOC 2 isn’t legally mandated, it’s nearly essential to the growth of your business. It assures customers, vendors, and partners that you have a strong security framework in place.
ISO 27001 is known as the international gold standard for information security management. ISO provides guidelines for companies so they can mitigate security risks by responsibly managing their people, processes, and technology.
Like SOC 2, the ISO 27001 framework does not fall under regulatory compliance, but obtaining an ISO certification proves your company’s security posture to global customers and partners.
The General Data Protection Regulation (GDPR) is the cornerstone of the European Union’s digital privacy legislation. GDPR requirements govern the collection, processing, consent, and distribution of personal information to ensure that EU citizens have more control over their own data.
Since GDPR falls under regulatory compliance, any company that wants to conduct business with EU citizens must adhere to this framework’s policies. Even if EU-based users are on your website, and you’re collecting or processing their data, you’re required by law to comply with GDPR requirements.
8 facts about GDPR compliance you need to know
Vanta's GDPR compliance checklist
The Healthcare Insurance Portability and Accountability Act (HIPAA) is a regulatory compliance framework that applies to any entity that collects or processes protected health information (PHI).
HIPAA ensures that companies ethically follow guidelines when it comes to keeping this highly sensitive data secure. Even if a company isn’t necessarily in the healthcare industry, the handling of protected health information requires an obligation to HIPAA.
The Payment Card Industry Data Security Standard (PCI DSS) is a required compliance framework for any business that accepts, processes, stores, transmits, or impacts the security of cardholder data. PCI DSS was created by major credit card entities in an effort to protect companies and their customers from data breaches, hacks, and other threats.
PCI is unique because it is not federally regulated, although some states have included it in their laws. PCI is more of a business agreement or contract. If you process credit card data and experience a breach without a PCI certification, you could be fined by your bank or payment processor.
The California Consumer Protection Act (CCPA) is a state law that grants residents the right to know about, delete, and opt-out of the processing and sale of their personal data. This regulatory framework applies to any business, regardless of location, that collects, uses, or sells the personal information of California residents.
CCPA was inspired by the European Union’s GDPR framework which protects EU citizens’ personal data. By achieving CCPA compliance, companies can sell into the largest US market without interruption or penalty.