Our tools reference ten cybersecurity and data protection frameworks. This page explains each one — what it is, whether it applies to your business, and where to go for the official source. All external links go directly to government or standards body sites.
The primary data protection law in the EU and UK. GDPR sets rules on how personal data is collected, stored, used, and deleted. It gives individuals rights over their own data — including the right to see it, correct it, and request deletion. Maximum fines: EUR 20M or 4% of global annual revenue, whichever is higher.
California's primary privacy law, strengthened by CPRA. Gives California residents rights to know what data is collected, opt out of its sale, and request deletion. Enforcement is by the California Privacy Protection Agency. Fines up to $7,500 per intentional violation. Over 20 other US states now have similar laws in effect or in progress.
US federal law governing the protection of health information (PHI — Protected Health Information). Requires administrative, physical, and technical safeguards. Civil fines range from $141 to over $71,000 per violation (2024 figures, adjusted annually for inflation), with annual caps up to $2.1M per violation category. Applies to covered entities and to any vendor or software provider that handles PHI on their behalf.
Security standards maintained by the PCI Security Standards Council, founded by Visa, Mastercard, American Express, and Discover. Version 4.0 is currently in effect. Non-compliance can result in fines from payment processors, loss of card acceptance rights, and liability for fraud losses after a breach.
The FCA regulates financial services firms in the UK, with requirements around operational resilience and cybersecurity. DORA is the EU equivalent — mandatory for financial entities from January 2025 — covering ICT risk management, incident reporting, operational resilience testing, and supply chain security. DORA applies to banks, insurers, investment firms, fintechs, and their technology providers.
The international standard for information security management (ISMS). Provides a systematic approach to managing sensitive information through people, processes, and technology. Certification requires an external audit by an accredited certification body. The current version is ISO 27001:2022. Recognised globally as the benchmark for organisational security maturity.
An auditing standard from the American Institute of CPAs. SOC 2 Type I confirms controls are properly designed at a point in time. SOC 2 Type II confirms those controls operated effectively over a 6-12 month period. Type II is the standard demanded by US enterprise customers. Covers five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Published by the National Institute of Standards and Technology, a US government agency. Organises cybersecurity activities into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Version 2.0 (2024) added Govern as a new function and expanded scope beyond critical infrastructure. Widely adopted globally as a best-practice reference.
The updated EU cybersecurity directive, replacing NIS1. Applied across EU member states from October 2024. NIS2 significantly expanded covered sectors (18 sectors including energy, transport, health, digital infrastructure, manufacturing, food, and public administration) and strengthened requirements for risk management, incident reporting within 24-72 hours, and supply chain security.
A UK government-backed certification scheme developed by the NCSC. Covers five key controls: firewalls, secure configuration, user access control, malware protection, and patch management. Two levels: Cyber Essentials (self-assessed, verified by certifying body) and Cyber Essentials Plus (independent technical verification). Certification typically costs GBP 300-500 for small businesses.
| Framework | Serving EU/UK Customers | Takes Card Payments | Healthcare | UK Business | Financial Services |
|---|---|---|---|---|---|
| GDPR | Yes | Yes | Yes | Yes | Yes |
| UK GDPR | If UK customers | If UK customers | If UK customers | Yes | Yes |
| CCPA | Threshold dependent | Threshold dependent | Threshold dependent | Threshold dependent | Threshold dependent |
| PCI-DSS | Only if cards | Yes | Only if cards | Only if cards | Only if cards |
| HIPAA | — | — | Yes | — | — |
| Cyber Essentials | — | — | — | Recommended | — |
| FCA / DORA | — | — | — | — | Yes |
| ISO 27001 | If required by customer | If required by customer | If required by customer | If required by customer | If required by customer |
| SOC 2 | If US customers require | If US customers require | If US customers require | — | If US customers require |
| NIST CSF | — | — | — | — | If US govt contracts |
| NIS2 | If 50+ employees in scope sector | — | Critical sector | — | Critical sector |