Which compliance frameworks apply to you?
Answer a few questions about what you sell, where your customers are and the data you handle. See which security frameworks customers will ask for and which privacy laws are likely to apply: SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA, PIPEDA and more.
Frameworks, laws and what customers ask for
Three different things decide what you need. Privacy and security laws apply because of where people are and what data you handle. Contracts and industry programmes, such as PCI DSS for card data or CMMC for US defense work, apply because of who you work with. And security frameworks like SOC 2 and ISO 27001 are rarely required by law, but customers ask for them before they sign.
SOC 2 or ISO 27001?
Both show customers that your security is managed and independently checked. SOC 2 is an auditor’s report and is the usual request from US customers. ISO 27001 is a certificate and is more common in Europe, the UK and Asia. Their controls overlap heavily, so many companies start with the one their customers ask for and add the other later.
Do privacy laws apply to B2B companies?
Yes. The GDPR, UK GDPR and PIPEDA protect any personal data, including the business contacts and employees of your customers. The CCPA has covered employee and business contact data since 2023. When you handle personal data on behalf of customers, you are usually their processor or service provider, and they will ask for a data processing agreement.
Frequently asked questions
Is this legal advice?
No. It points you to the frameworks and laws your answers suggest, with the reason for each, so you know what to check. Laws have exceptions and thresholds; confirm with a qualified adviser.
Does HIPAA apply if we only host data for clinics?
Usually yes. A company that creates, receives, keeps or sends health information for a healthcare provider or health plan is a business associate and must sign a business associate agreement and meet the HIPAA Security Rule.
Do we need PCI DSS if we use a payment provider?
If card details go straight to the provider’s hosted page or form and never touch your systems, your scope is much smaller, often a short self-assessment questionnaire. You are still responsible for confirming it with your acquiring bank.
Is this tool free?
Yes. No account is needed. If you add your contact details and download the PDF, Sourceably saves them so our team can help you, unless you tick "Don’t contact me".