Understand Your Compliance Requirements
Not sure which regulations apply to your business? Browse our framework guides to understand what's required, who needs it, and how ComplyZen can help.
HIPAA
Health Insurance Portability and Accountability ActRequired for any business that handles protected health information (PHI). Covers healthcare providers, health plans, and their business associates.
Who needs this: Healthcare providers, health tech companies, medical billing, telehealth platforms, health insurance
Industry Checklists
SOC 2
Service Organization Control 2A trust-based security framework for service organizations. Demonstrates your company handles customer data securely. Often required by enterprise clients.
Who needs this: SaaS companies, cloud service providers, data centers, IT managed services, fintech
GDPR
General Data Protection RegulationThe EU's comprehensive data protection regulation. Applies to any business that processes personal data of EU residents, regardless of where the business is located.
Who needs this: Any business with EU customers or users, e-commerce, SaaS, marketing platforms
Industry Checklists
CCPA / CPRA
California Consumer Privacy Act / California Privacy Rights ActCalifornia's landmark privacy law giving residents rights over their personal data. Applies to businesses meeting certain revenue or data processing thresholds.
Who needs this: Businesses with California customers, especially those with $25M+ revenue or handling 100K+ consumers' data
Industry Checklists
PCI DSS
Payment Card Industry Data Security StandardRequired for any business that stores, processes, or transmits credit card data. Ensures secure handling of cardholder information.
Who needs this: E-commerce, retail, restaurants, subscription services, payment processors
Industry Checklists
ISO 27001
International Organization for Standardization 27001The international standard for information security management systems (ISMS). Provides a systematic approach to managing sensitive company and customer information.
Who needs this: Technology companies, financial services, government contractors, global enterprises
Industry Checklists
NIST CSF
National Institute of Standards and Technology Cybersecurity FrameworkA voluntary framework providing guidelines for managing cybersecurity risk. Widely adopted across industries as a best-practice framework.
Who needs this: Government contractors, critical infrastructure, financial services, healthcare
DORA
Digital Operational Resilience ActEU regulation ensuring financial sector entities can withstand, respond to, and recover from ICT-related disruptions and threats.
Who needs this: Banks, insurance companies, investment firms, fintech, and ICT service providers operating in the EU
STATE GUIDES
Compliance by State
Every state has different privacy laws and compliance requirements. Find your state's specific obligations.
Not sure which frameworks apply to you?
Our AI assessment wizard analyzes your industry, data types, and operating regions to tell you exactly which regulations you need to comply with.
Run Free Assessment →