LFCA 107 🐧 GDPR, HIPAA, and PCI — Overview - KandZ

This chapter covers the three major compliance frameworks that govern how organizations protect sensitive data: the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS). Each framework addresses a different category of data, applies to different organizations, and carries different enforcement mechanisms. Understanding their scope, core requirements, and differences is essential for the LFCA exam’s Security Fundamentals domain, which includes compliance as a competency .

Key point: GDPR protects EU personal data, HIPAA protects US health information, and PCI DSS protects payment card data. Each requires encryption, access controls, and auditing, but they differ in enforcement, penalties, and specificity.

Why these three frameworks exist

The data-specific protection problem. Different categories of data require different protections. A person’s health records carry different risks than their credit card number, which carries different risks than their email address. GDPR, HIPAA, and PCI DSS each define protections appropriate to the data type they govern .

The legal-versus-contractual distinction. GDPR and HIPAA are laws enforced by government authorities. PCI DSS is a contractual standard enforced by payment card brands and acquiring banks . This difference shapes how compliance is achieved and what happens when it fails.

The enforcement problem. Penalties vary widely. GDPR fines can reach €20 million or 4% of global turnover . HIPAA penalties can reach $2.1 million per violation category per year . PCI DSS penalties typically range from $5,000 to $100,000 per month .

The overlapping requirements problem. An organization may need to comply with all three. A hospital that accepts credit cards handles PHI, personal data, and cardholder data simultaneously. The controls overlap significantly, but the documentation and enforcement mechanisms differ.

a. GDPR: General Data Protection Regulation

The GDPR is an EU regulation that protects natural persons with regard to the processing of personal data and the free movement of such data . It applies to any organization processing personal data of individuals in the EU, regardless of the organization’s location.

Core principles. Article 5 establishes six principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; and integrity and confidentiality . The controller must also be able to demonstrate compliance, which is the accountability principle .

Data subject rights. Individuals have the right to erasure (“right to be forgotten”) under Article 17 , the right to access their data, the right to rectification, the right to restriction of processing, and the right to data portability.

Key requirements. Encrypt personal data at rest and restrict access to authorized services . The storage limitation principle requires keeping personal data no longer than necessary for the stated purpose .

Enforcement. Data Protection Authorities (DPAs) in each EU member state monitor and supervise compliance. They have investigative and corrective powers . Penalties for severe violations can reach €20 million or 4% of global turnover .

b. HIPAA: Health Insurance Portability and Accountability Act

HIPAA is a US law that establishes national standards to protect individuals’ medical records and other individually identifiable health information, collectively defined as protected health information (PHI) . It applies to health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically .

Privacy Rule requirements. The Privacy Rule requires appropriate safeguards to protect the privacy of PHI and sets limits on uses and disclosures without individual authorization . It gives individuals rights over their PHI, including the right to examine and obtain a copy of their records .

Minimum necessary standard. Covered entities must make reasonable efforts to limit use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose . Treatment disclosures between providers are exempt from this standard .

Security Rule requirements. Organizations must implement physical, technical, and administrative safeguards for electronic PHI . Encryption of data transfers using TLS is required, along with strict access controls . Encryption is currently an “addressable” implementation specification, meaning it must be implemented if reasonable or an alternative documented .

Enforcement. The Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) enforce HIPAA. Penalties range from $141 to $71,162 per violation, with a maximum of $2.1 million per calendar year per violation category .

c. PCI DSS: Payment Card Industry Data Security Standard

PCI DSS is a global security standard governing the storage, processing, and transmission of credit cardholder data . It is not a law; it is a contractual requirement imposed by the payment card brands through acquiring banks .

Scope. PCI DSS applies to any organization that stores, processes, or transmits cardholder data . This includes merchants, service providers, and any system that can affect the cardholder data environment.

Key requirements. Cardholder data must be encrypted in transit and at rest . Strong access controls must be enforced, including authentication and authorization . All access to payment information must be monitored and audited .

Log retention. PCI DSS requires logs to be retained for at least 12 months, with at least 3 months immediately available for analysis . This is a hard requirement, unlike HIPAA which sets no fixed retention period .

Enforcement. The PCI Security Standards Council develops the standard but has no legal authority. Enforcement falls to acquiring banks through contractual relationships . Penalties typically range from $5,000 to $100,000 per month .

d. Comparing the three frameworks

Aspect	GDPR	HIPAA	PCI DSS
Scope	EU personal data	US protected health information	Payment card data
Legal status	Law	Law	Contractual standard
Authority	Data Protection Authorities	HHS/OCR	Acquiring banks
Max penalty	€20M or 4% turnover	$2.1M per category/year	$5K–$100K/month
Encryption	Risk-based, appropriate measures	Addressable, recommended	Required in transit and at rest
Log retention	Not specified	Not specified	12 months (3 immediately available)
Enforcement rate (2022)	~87%	~92%	~32%

The enforcement gap is significant. HIPAA reached approximately 92% implementation and GDPR approximately 87% in 2022, while PCI DSS was only about 32% . The study attributes this to enforcement design: HIPAA and GDPR rely on public authorities with investigative powers, while PCI DSS enforcement depends on acquiring banks that maintain commercial relationships with the merchants they regulate .

Complete Example Session

# ============================================
# PART 1: IDENTIFY WHICH FRAMEWORKS APPLY
# ============================================
# An organization handling EU personal data,
# US health records, and credit cards must
# comply with GDPR, HIPAA, and PCI DSS.

# ============================================
# PART 2: ENCRYPT DATA AT REST (GDPR)
# ============================================
# Encrypt personal data in the database.
sudo cryptsetup luksFormat /dev/sdb
sudo cryptsetup open /dev/sdb encrypted_data

# ============================================
# PART 3: ENCRYPT DATA IN TRANSIT (HIPAA)
# ============================================
# Use TLS for all PHI transfers.
ssl_protocols TLSv1.3;
ssl_ciphers 'TLS_AES_256_GCM_SHA384';

# ============================================
# PART 4: RESTRICT ACCESS (PCI DSS)
# ============================================
# Apply least privilege to cardholder data.
GRANT SELECT ON payments.cards TO 'app_user'@'localhost';
REVOKE ALL PRIVILEGES FROM 'app_user'@'localhost';

# ============================================
# PART 5: ENABLE AUDIT LOGGING (PCI DSS)
# ============================================
# PCI DSS requires 12-month log retention.
log_statement = 'all'
log_connections = on
log_disconnections = on

# ============================================
# PART 6: RESPOND TO DATA SUBJECT REQUEST (GDPR)
# ============================================
# Right to erasure under Article 17.
DELETE FROM users WHERE email = 'user@example.com';

# ============================================
# PART 7: APPLY MINIMUM NECESSARY (HIPAA)
# ============================================
# Limit PHI access to what is needed.
# Restrict based on role, not blanket access.

# ============================================
# PART 8: DOCUMENT COMPLIANCE
# ============================================
# Records of processing activities for GDPR.
# Security risk analysis for HIPAA.
# Attestation of Compliance for PCI DSS.

These parts cover identifying applicable frameworks, encryption at rest and in transit, access controls, audit logging, data subject requests, minimum necessary, and documentation.

Quick Reference

Framework Summary

Framework	Protects	Enforced By	Penalty Cap
GDPR	EU personal data	Data Protection Authorities	€20M or 4% turnover
HIPAA	US health information	HHS/OCR	$2.1M per category/year
PCI DSS	Payment card data	Acquiring banks	$100K/month

Core Requirements Comparison

Requirement	GDPR	HIPAA	PCI DSS
Encryption at rest	Risk-based	Addressable	Required
Encryption in transit	Risk-based	Required (TLS)	Required
Access control	Required	Required	Required with MFA
Audit logging	Accountability principle	Required	12-month retention
Data retention	Storage limitation	No fixed period	No fixed period

GDPR Principles (Article 5)

Principle	Meaning
Lawfulness, fairness, transparency	Legal basis and clear communication
Purpose limitation	Specific, explicit purposes
Data minimization	Only necessary data
Accuracy	Correct and current
Storage limitation	Keep only as long as needed
Integrity and confidentiality	Appropriate security

Best Practices

✅ Do This:

# Encrypt sensitive data at rest and in transit
# Apply least privilege to all data access
# Document processing activities and safeguards
# Enable audit logging with retention
# Honor data subject requests within timeframes
# Conduct security risk analysis

❌ Don’t Do This:

# Store personal data without legal basis
# Grant broad access to PHI or cardholder data
# Keep data indefinitely without justification
# Ignore data subject access requests
# Assume PCI DSS compliance without attestation

Common Pitfalls

Pitfall	Why It Happens	Fix
Assuming one framework covers all	Different data types	Identify all applicable frameworks
Confusing HIPAA encryption	“Addressable” not optional	Implement or document alternative
Missing PCI DSS log retention	12-month requirement	Configure log rotation and retention
Ignoring GDPR erasure	No process	Implement data subject request handling
PCI DSS enforcement gap	Acquiring banks have commercial ties	Self-attestation and evidence

Real-World Examples

1. GDPR Consent

<!-- Opt-in consent for data processing -->
<button>Accept All</button>
<button>Reject Non-Essential</button>

2. HIPAA Minimum Necessary

# Limit PHI access to role requirements
GRANT SELECT ON patient_records TO 'nurse'@'%';
# Not: GRANT ALL ON patient_records

3. PCI DSS Encryption

# Encrypt cardholder data at rest
openssl enc -aes-256-cbc -in cards.db -out cards.db.enc

4. GDPR Data Subject Access

# Export user data on request
SELECT * FROM users WHERE id = 123;
SELECT * FROM orders WHERE user_id = 123;

5. HIPAA Audit Control

# Record access to PHI
sudo auditctl -w /var/lib/health_records -p rwxa

6. PCI DSS Log Retention

# Retain logs for 12 months
logrotate -f /etc/logrotate.d/pci

7. GDPR Breach Notification

# Notify DPA within 72 hours

8. HIPAA Business Associate Agreement

# Required for vendors handling PHI

9. PCI DSS Attestation

# Complete Attestation of Compliance (AOC)

10. Multi-Framework Compliance

# Implement controls that satisfy all three:
# Encryption, access control, audit logging

Visual

Scope Comparison

┌──────────────────────────────────────────────────────────────┐
│  GDPR                    HIPAA                  PCI DSS      │
│  ┌─────────────┐        ┌─────────────┐      ┌─────────────┐ │
│  │ EU personal │        │ US health   │      │ Payment     │ │
│  │ data        │        │ information │      │ card data   │ │
│  └─────────────┘        └─────────────┘      └─────────────┘ │
│                                                              │
│  Law                    Law                  Contract        │
│  DPA enforcement        HHS/OCR              Acquiring banks │
└──────────────────────────────────────────────────────────────┘

Penalty Comparison

┌──────────────────────────────────────────────────────────────┐
│  GDPR: €20M or 4% global turnover                            │
│  ████████████████████████████████████████████████████████    │
│                                                              │
│  HIPAA: $2.1M per category per year                          │
│  ████████████████████████████████                            │
│                                                              │
│  PCI DSS: $5K–$100K per month                                │
│  ████                                                        │
└──────────────────────────────────────────────────────────────┘

Enforcement Rates (2022)

┌──────────────────────────────────────────────────────────────┐
│  HIPAA    ████████████████████████████████████████████  92%  │
│  GDPR     ███████████████████████████████████████████   87%  │
│  PCI DSS  █████████████████                              32%  │
│                                                              │
│  PCI DSS enforcement falls to acquiring banks with           │
│  commercial relationships to merchants.                      │
└──────────────────────────────────────────────────────────────┘

Core Controls Across Frameworks

┌──────────────────────────────────────────────────────────────┐
│  CONTROL              │ GDPR    │ HIPAA   │ PCI DSS           │
│  ─────────────────────┼─────────┼─────────┼─────────────────  │
│  Encryption at rest   │ Risk    │ Address │ Required          │
│  Encryption transit   │ Risk    │ TLS     │ Required          │
│  Access control       │ Req     │ Req     │ Req + MFA         │
│  Audit logging        │ Account │ Req     │ 12-month retain   │
│  Data retention       │ Limit   │ None    │ None              │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
GDPR	EU regulation protecting personal data
GDPR principles	Lawfulness, purpose limitation, minimization, accuracy, storage limitation, integrity
GDPR rights	Access, rectification, erasure, restriction, portability
HIPAA	US law protecting protected health information
HIPAA minimum necessary	Limit PHI to minimum needed for purpose
HIPAA enforcement	HHS/OCR; $2.1M per category per year
PCI DSS	Contractual standard for payment card data
PCI DSS requirements	Encryption in transit/at rest, access control, 12-month logs
PCI DSS enforcement	Acquiring banks; $5K–$100K per month
Common controls	Encryption, access control, audit logging

Key takeaways:

GDPR protects EU personal data. It applies extraterritorially to any organization processing data of EU residents. Its six principles and data subject rights form the foundation of EU data protection law .
HIPAA protects US health information. It requires safeguards for protected health information, with the minimum necessary standard governing access . Encryption is addressable, meaning it must be implemented or an alternative documented .
PCI DSS protects payment card data. It is the most prescriptive of the three, requiring encryption in transit and at rest, MFA for access, and 12-month log retention .
Enforcement differs fundamentally. GDPR and HIPAA are laws enforced by public authorities. PCI DSS is a contractual standard enforced by acquiring banks, which maintains commercial relationships with the merchants they regulate .
Enforcement rates reflect the design. HIPAA (92%) and GDPR (87%) have higher compliance rates than PCI DSS (32%) because public authorities have stronger enforcement powers than contractual relationships .
The core controls overlap. Encryption, access control, and audit logging appear in all three frameworks. An organization that builds strong controls for one framework is most of the way toward the others .
Penalties vary widely. GDPR can impose fines up to €20 million or 4% of global turnover. HIPAA can reach $2.1 million per violation category. PCI DSS penalties typically range from $5,000 to $100,000 per month .

Remember: GDPR, HIPAA, and PCI DSS are not interchangeable. Each protects a different category of data, applies to different organizations, and is enforced through different mechanisms. GDPR protects EU personal data and is enforced by Data Protection Authorities. HIPAA protects US health information and is enforced by HHS/OCR. PCI DSS protects payment card data and is enforced by acquiring banks. The core technical requirements—encryption, access control, and auditing—overlap significantly, but the documentation, retention periods, and penalties differ. An organization that handles multiple data types must comply with multiple frameworks, and the controls that satisfy one are often relevant to the others. Understanding the scope and enforcement of each framework is essential for any IT professional working with sensitive data.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!