Data Privacy Compliance: GDPR, HIPAA, CCPA, and India's DPDP

Data privacy compliance is the work of knowing whose personal data you process, under which law, with which vendors, and with which rights requests you can actually fulfill. AI-native teams trip here because training sets, prompt logs, and evaluation traces are personal data the moment they include user content, support tickets, or health-adjacent text.

This hub covers GDPR, HIPAA, CCPA/CPRA, and India's DPDP Act. ISO 42001 belongs in the same operating picture whenever models process that data: privacy law tells you whether you may process; an AI management system tells you how the system is governed. ISO 27001 remains the security spine. We are not running a SOC 2 series in this sprint; US buyers may still mention SOC 2 in the same email as privacy exhibits.

GDPR: extra-territorial rules, not an EU office requirement

The General Data Protection Regulation applies to processing personal data of people in the EU/EEA when you offer goods or services or monitor behavior, even if the company is incorporated in India. Lawful basis, purpose limitation, data processing agreements, and transfer tools are the usual gaps. Security of processing overlaps an ISMS; lawful basis does not.

Read the regulation itself on EUR-Lex instead of a vendor one-pager. If UK users matter, treat UK GDPR as a sibling program, not a footnote. Packets' GDPR page is the product entry; this article is the map.

HIPAA: sector law, not a general privacy badge

HIPAA applies to covered entities and business associates handling protected health information in the United States. A generic SaaS analytics tool is not "HIPAA certified" because it bought encryption. If you are a business associate, you need a BAA, Security Rule safeguards, and breach processes that match HHS expectations. Primary orientation: HHS HIPAA and Packets' HIPAA solution.

Do not use HIPAA as a substitute for GDPR. PHI in an EU user's record can implicate both. Data privacy compliance programs that smash them into one policy page fail the first serious legal review.

CCPA and CPRA: California consumer rights with thresholds

The California Consumer Privacy Act, expanded by CPRA, gives California residents rights to know, delete, correct, and opt out of sale or sharing of personal information, with revenue and volume thresholds that decide whether you are in scope. It is not GDPR-with-a-US-accent. Opt-out mechanics, service-provider contracts, and "sale/share" analysis are the usual misses. The California Attorney General maintains a CCPA overview.

If you only have a handful of California users and sit under the thresholds, document that analysis. If you are clearly in scope, treat data privacy compliance as an operational queue: request intake, identity verification, vendor cascade, not a privacy policy rewrite once a year.

India's DPDP Act: do not assume GDPR covers you at home

The Digital Personal Data Protection Act, 2023 applies to digital personal data linked to India, including certain processing outside India when you offer goods or services to people in India. Consent design, children's data (the Act treats people under 18 as children), and government directions on cross-border transfers differ from GDPR's adequacy and SCC model. MeitY publishes the Act text via official channels; start from the ministry rather than a LinkedIn carousel.

Packets' ICP is often an Indian company selling to US/EU enterprise. That means data privacy compliance is usually three layers: DPDP for Indian principals, GDPR/UK GDPR for European users and many enterprise DPAs, and US state or sector rules (CCPA, HIPAA) when those buyers or those data types appear. ISO 42001 does not replace any of those statutes. It does give you a place to record how models use personal data, which privacy counsel will ask for anyway.

How to run data privacy compliance without a privacy office

Inventory processing: product, support, marketing, AI fine-tunes, logs. Name a controller vs processor role per flow. Put subprocessors in a list you can actually update. Wire rights requests to a human owner even if a ticket form collects them. Map ISO 27001 access and deletion controls to privacy obligations so security and legal are not maintaining two asset lists.

When models are in the path, add the 42001-shaped questions: training data provenance, retention of prompts, output leakage, vendor model terms. That is how data privacy compliance stays honest in an AI company rather than pretending ChatGPT wrappers are "just infrastructure."

Packets implements this as part of end-to-end compliance work: end-to-end compliance, with a specialist who will say when you need outside counsel. We are not your law firm. For a structured gap view, use the free audit score.

Frequently asked questions

If we complete ISO 27001, is data privacy compliance done?

No. An ISMS supports security measures. It does not pick lawful bases, answer DSARs by itself, or satisfy HIPAA BAAs.

Does ISO 42001 count as a privacy certification?

No. ISO 42001 is an AI management system. Use it alongside data privacy compliance obligations, not instead of them.

Can one privacy policy cover GDPR, CCPA, HIPAA, and DPDP?

You can publish one public policy with sections. You cannot run one operational process and hope. The laws trigger different rights, timelines, and definitions of sale, PHI, and child.

Where should a 40-person team start?

Start with a processing inventory and the laws your current customers already invoke in contracts. Then implement request handling. Then tighten AI data paths. Contact Packets if you want that sequenced as a program rather than a document dump.

For India-plus-enterprise context, also see B2B SaaS and AI companies.