Regulations
The dashboard's Sensitive data view names the regulations a finding may touch. Each one here in plain words, with its source. This page is not legal advice.
GDPR / UK GDPR
EU and UK privacy law: personal data must be protected and shared only when needed.
Provisions: Art. 4(1), 9, 32, 33. Source: Regulation (EU) 2016/679 and UK GDPR.
CCPA / CPRA
California privacy law: sensitive personal information needs extra care.
Provisions: 1798.140(ae) sensitive PI. Source: California Consumer Privacy Act.
HIPAA
US health privacy law: anything that identifies a patient must be protected.
Provisions: 164.514(b) Safe Harbor. Source: 45 CFR 164.514.
PCI DSS v4
The card industry standard: card numbers must never be exposed.
Provisions: Req. 3.4. Source: PCI DSS document library.
LGPD
Brazil's privacy law: personal data needs protection and a lawful reason to be shared.
Provisions: Art. 5, 11, 46. Source: Lei 13.709/2018.
DPDP Act (India)
India's privacy law: personal data must be kept safe from leaks.
Provisions: Sec. 8(5). Source: Digital Personal Data Protection Act, 2023.
EU Trade Secrets Directive
EU law: a trade secret stays protected only while you take reasonable steps to keep it secret.
Provisions: Art. 2(1)(c) reasonable steps. Source: Directive (EU) 2016/943.
ISO/IEC 27001:2022
Information security standard: sensitive data must be masked and kept from leaking.
Provisions: A.8.11 masking, A.8.12 DLP. Source: ISO/IEC 27001:2022.
SOC 2
Audit standard for service companies: secrets and confidential data must stay access-controlled.
Provisions: CC6.1, CC6.7. Source: AICPA SOC suite of services.
NIS2 / DORA
EU cyber-resilience rules: the keys and passwords to your systems must be protected.
Provisions: NIS2 Art. 21, DORA Art. 9. Source: Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2022/2554 (DORA).