Your Compliance and regulatory Professionals

Although GDPR is an EU regulation, it has extraterritorial scope and affects US companies that process personal data of EU residents. It establishes requirements for data protection and privacy.

HIPAA regulates the protection of personal health information (PHI) held by covered entities such as healthcare providers, health plans, and healthcare clearinghouses.

The CCPA provides California residents with certain rights regarding their personal information collected by businesses, including the right to know, delete, and opt-out of the sale of their data.

The GLBA applies to financial institutions and requires them to provide notice to consumers about their privacy practices and to safeguard personal financial information.

COPPA imposes requirements on operators of websites or online services that collect personal information from children under the age of 13, aiming to protect their privacy and safety online.

The FCRA regulates the collection, dissemination, and use of consumer information by credit reporting agencies, promoting accuracy, fairness, and privacy of consumer data.

FERPA protects the privacy of student education records maintained by educational institutions that receive federal funding, ensuring parental rights and student privacy.

ITAR controls the export and import of defense-related articles, services, and technical data, including privacy and security provisions related to defense-related information.

Standard for securing credit card transactions, ensuring safe handling of cardholder information.

 SOC 1 focuses on internal controls over financial reporting (ICFR) and is intended for auditors and users of financial statements. It includes two types of reports: Type I, which assesses the design of controls at a specific point in time, and Type II, which evaluates the operating effectiveness of those controls over a period of time.

 SOC 2 addresses controls related to security, availability, processing integrity, confidentiality, and privacy, following the Trust Services Criteria. It is designed for stakeholders such as clients, partners, and regulators who need assurance about data protection and privacy practices. SOC 2 also includes Type I and Type II reports, similar to SOC 1. 

 SOC 3 offers a high-level overview of the same criteria covered in SOC 2 but is intended for a general audience. This report is publicly available and provides a summary of the organization’s controls without the detailed descriptions and testing results found in SOC 2 reports.