Compliance Regimes

Pre-configured compliance settings for specific frameworks.

HIPAA

Healthcare data protection:

{
  "regime": "hipaa",
  "settings": {
    "phi_detection": "required",
    "phi_action": "encrypt",
    "audit_retention_years": 6,
    "access_logging": "comprehensive",
    "baa_required": true
  }
}

Requirements Met

• PHI detection and handling
• Minimum necessary access
• Audit trail retention
• Encryption at rest
• BAA support

GDPR

EU data protection:

{
  "regime": "gdpr",
  "settings": {
    "data_residency": "eu",
    "right_to_erasure": true,
    "consent_tracking": true,
    "data_portability": true
  }
}

Requirements Met

• Data residency controls
• Right to be forgotten
• Data portability export
• Consent management
• Processing records

Legal Hold

Litigation preservation:

{
  "regime": "legal_hold",
  "settings": {
    "preservation_scope": "all",
    "deletion_blocked": true,
    "modification_logging": "strict"
  }
}

EU AI Act

AI system compliance:

{
  "regime": "eu_ai_act",
  "settings": {
    "risk_classification": "high",
    "human_oversight": "required",
    "transparency_logging": true
  }
}

Combining Regimes

{
  "regimes": ["hipaa", "gdpr"],
  "conflict_resolution": "strictest"
}

Next Steps

• EU AI Act - AI-specific compliance
• Reports - Compliance attestations