Photo: Shixart1985 / Wikimedia Commons, CC BY 2.0
GDPR, HIPAA and PCI DSS are three of the most-mentioned acronyms in data protection, and three of the most misunderstood. Some small-business owners assume none of them apply because they’re “too small.” Others assume all of them apply and freeze at the thought of paperwork. The reality sits in between: each one applies to specific kinds of businesses handling specific kinds of data, and size alone rarely gets you off the hook.
The encouraging part is that the three frameworks ask for many of the same things: know what data you hold, limit who can access it, protect it with sensible security controls, work only with trustworthy vendors, and have a plan for when something goes wrong. Build those habits once and you’re most of the way toward meeting all three.
This guide explains, in plain English, who each framework covers, what it requires, and how a small team can approach compliance without a legal department. It’s general information, not legal advice; for decisions about your specific obligations, talk to a qualified attorney or compliance professional.
Key takeaways
- GDPR can apply to a US business that offers goods or services to people in the EU or monitors their behavior, regardless of company size.
- HIPAA applies to covered entities (most healthcare providers, health plans and clearinghouses) and to their business associates, including many IT and service vendors.
- PCI DSS is a contractual standard for anyone who accepts, processes, stores or transmits payment card data.
- All three expect risk assessment, access control, encryption, vendor oversight and incident response.
- Outsourcing to a cloud or payment provider reduces your burden but never removes your responsibility.
Which rules apply to you?
Start by answering three questions. Do you collect personal data from people in the European Union? Do you handle health information on behalf of a healthcare provider or health plan, or are you one? Do you accept credit or debit cards? Your answers point to the frameworks you need to understand.
| GDPR | HIPAA | PCI DSS | |
|---|---|---|---|
| What it is | EU regulation (law) | US federal law and regulations | Industry standard enforced by contract |
| Data covered | Any personal data about people in the EU | Protected health information (PHI) | Payment card data |
| Who it applies to | Organizations in the EU, plus those outside it that target or monitor people in the EU | Covered entities and their business associates | Merchants and service providers that handle card data |
| Who enforces it | EU data protection authorities | HHS Office for Civil Rights, plus state attorneys general | Card brands through your acquiring bank or payment processor |
| Consequences | Fines, orders to stop processing, claims from individuals | Civil and criminal penalties, corrective action plans | Fees, higher processing costs, loss of ability to take cards |
Many US states also have their own privacy and data breach notification laws, and the FTC enforces against unfair or deceptive data practices more broadly. This article focuses on the three frameworks most small businesses ask us about.
GDPR: when a US small business is in scope
The General Data Protection Regulation took effect in 2018 and protects personal data of people in the European Union. “Personal data” is broad: names, email addresses, IP addresses, customer records, employee files and even cookie identifiers can all count.
Does it apply to you?
Under Article 3, GDPR applies to organizations outside the EU when they offer goods or services to people in the EU or monitor their behavior there. Signs that you may be in scope include shipping to EU countries, pricing in euros, marketing to EU audiences, or using tracking and analytics to profile EU website visitors. Simply having a website that someone in Europe can visit is generally not enough by itself. If you’re unsure, this is a good question for a privacy attorney.
Note that the UK has its own version, the UK GDPR, with very similar requirements.
What it requires
The core principles in Article 5 ask that personal data be processed lawfully, fairly and transparently; collected for specific purposes; limited to what’s necessary; kept accurate; stored no longer than needed; and protected with appropriate security. In practice, a small business should:
- Identify a lawful basis (such as consent, contract or legitimate interests) for each way it uses personal data
- Publish a clear privacy notice explaining what you collect, why, and how people can exercise their rights
- Be ready to respond to requests to access, correct or delete data, generally within one month
- Sign data processing agreements with vendors that handle personal data for you, as required by Article 28
- Apply “appropriate technical and organizational measures” to secure data, as described in Article 32
- Have a process to assess breaches and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of them
You can read the full text, article by article, at gdpr-info.eu. Non-EU businesses in scope may also need to appoint a representative in the EU, subject to some exceptions.
The stakes
The most serious GDPR infringements can be fined up to 20 million euros or 4% of global annual turnover, whichever is higher. Small businesses rarely face penalties of that size, but regulators do act against smaller organizations, and the reputational cost of a mishandled breach can be significant.
HIPAA: covered entities and business associates
The Health Insurance Portability and Accountability Act protects health information in the United States. It’s narrower than many people assume: not all health data is covered by HIPAA, and not every business that touches health topics is subject to it.
Who must comply
- Covered entities: health plans, healthcare clearinghouses, and healthcare providers (doctors, dentists, therapists, clinics, pharmacies and others) that conduct certain transactions electronically, such as billing insurance.
- Business associates: vendors that create, receive, maintain or transmit protected health information on behalf of a covered entity. This commonly includes IT providers, cloud hosting, billing companies, transcription services, consultants and shredding services.
If you’re a business associate, the covered entity must have a signed Business Associate Agreement (BAA) with you, and you must have BAAs with any subcontractors who handle that data.
The three main rules
- Privacy Rule: governs how PHI may be used and disclosed and gives patients rights over their information.
- Security Rule: requires administrative, physical and technical safeguards for electronic PHI. The foundation is a documented risk analysis, followed by risk management, access controls, audit logging, workforce training, contingency planning and more.
- Breach Notification Rule: requires notifying affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Breaches affecting 500 or more people must also be reported to HHS within that window and, in some cases, to the media; smaller breaches are logged and reported to HHS annually.
HHS publishes extensive guidance at HHS.gov/hipaa, including a free Security Risk Assessment Tool built for small and medium-sized practices. HHS also proposed significant updates to the Security Rule in early 2025, with more explicit expectations around areas such as MFA, encryption and asset inventories. Check HHS for the current status, and treat those proposed controls as good practice either way.
If you run a health or wellness app that isn’t connected to a covered entity, HIPAA may not apply, but the FTC’s Health Breach Notification Rule might.
PCI DSS: if you take card payments
The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council, founded by the major card brands. It isn’t a government law. You agree to it through your merchant agreement with your bank or payment processor, which is why the consequences of non-compliance tend to be fees and contract terms rather than government fines. The current version is PCI DSS v4.0.1, and the documents are available from the PCI Security Standards Council.
How small merchants validate compliance
Most small businesses fall into the lowest merchant level and validate compliance by completing a Self-Assessment Questionnaire (SAQ) and an Attestation of Compliance each year, sometimes with quarterly external vulnerability scans. Which SAQ you use depends on how you accept cards:
- SAQ A: online businesses that fully outsource payment pages to a compliant provider, for example through a redirect or embedded payment form
- SAQ A-EP: e-commerce sites that partly outsource but whose website can affect the security of the payment transaction
- SAQ B and B-IP: businesses using standalone card terminals
- SAQ C-VT: businesses that key card numbers into a web-based virtual terminal
- SAQ P2PE: businesses using a validated point-to-point encryption solution
- SAQ D: everyone else, including businesses that store card data, which is by far the most demanding
Ask your payment processor which SAQ applies to you; many provide a portal that walks you through it.
Shrink your scope
The easiest way to make PCI DSS manageable is to keep card data away from your systems entirely. Use hosted payment pages and tokenization online, use encrypting terminals in person, and never store full card numbers or security codes. Don’t accept card details by email, chat or text, and don’t write them down. Every system that touches card data is in scope, so fewer systems mean fewer requirements.
Watch out
Using a compliant provider doesn’t make you compliant. A payment processor may be PCI DSS validated, but you still need to complete your own SAQ and secure your website and devices. Microsoft and Google offer BAAs for certain services, but you must sign the agreement and configure those services correctly before storing PHI. Under GDPR, you remain accountable for the vendors you choose. Responsibility can be shared, but it can’t be handed off completely.
Where the three overlap
Look past the different vocabulary and the three frameworks ask for strikingly similar things. That’s good news: one well-run security program can satisfy most of each.
| Common control | Why it matters for all three |
|---|---|
| Data inventory and mapping | You can’t protect or report on data you don’t know you have |
| Risk assessment | Explicitly required by HIPAA; expected by GDPR and PCI DSS |
| Access control and MFA | Limits who can see sensitive data and blocks stolen-password attacks |
| Encryption | Protects data on lost devices and in transit; can reduce breach obligations |
| Logging and monitoring | Shows who accessed what and supports investigations |
| Vendor management | Data processing agreements, BAAs and service provider checks |
| Training | Required by HIPAA and PCI DSS; essential for GDPR accountability |
| Incident response | All three have notification or reporting obligations after a breach |
A practical compliance roadmap for small teams
Work through these steps in order. Each one builds on the last, and documenting as you go creates the evidence regulators, auditors and customers will ask for.
- Map your data: what personal, health and payment data you collect, where it’s stored, who can access it and which vendors handle it
- Decide which frameworks apply, and confirm with an attorney or your payment processor where you’re unsure
- Reduce what you hold: delete data you don’t need and outsource card handling where possible
- Run a risk assessment and record the results
- Close the biggest gaps first: MFA, encryption, patching, backups and access reviews
- Sign the right contracts: BAAs, data processing agreements and service provider agreements
- Write short, clear policies for data handling, access, acceptable use and incident response
- Train staff on what the rules mean for their daily work
- Write and test a breach response plan with notification timelines
- Review everything at least once a year and after major changes
An independent review is a good way to check your progress. Our article on what happens during an IT security audit explains what to expect, and our guide to vendor and third-party risk covers how to vet the providers who handle your regulated data.
How SecuritySage can help
Compliance doesn’t have to mean a binder of documents nobody reads. We help small businesses translate GDPR, HIPAA and PCI DSS requirements into practical controls and plain-English policies through our Security Policy Development service, and we offer ongoing guidance through our Virtual CISO advisory for teams that need a security leader without a full-time hire. We work alongside your legal counsel rather than replacing it.
Not sure which rules apply to you or where to begin? Get started with SecuritySage and we’ll help you map your obligations and build a realistic plan.
Frequently asked questions
Does GDPR apply to a small US business?
It can. GDPR applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there, regardless of company size. Signs you may be in scope include shipping to EU countries, marketing to EU audiences or profiling EU website visitors. This is general information, not legal advice, so confirm your situation with a privacy attorney.
Is my IT provider or software vendor subject to HIPAA?
If a vendor creates, receives, maintains or transmits protected health information on behalf of a covered entity, it is generally a business associate under HIPAA. Business associates must sign a Business Associate Agreement and comply with the HIPAA Security Rule. Many IT, cloud, billing and consulting providers fall into this category.
Do I need to comply with PCI DSS if I use Square, Stripe or another payment processor?
Yes. Any business that accepts card payments must comply with PCI DSS, but using a hosted payment page or encrypting terminal can greatly reduce how many requirements apply. Most small merchants complete a Self-Assessment Questionnaire each year, and your processor can tell you which one fits how you take payments.
Can one security program cover GDPR, HIPAA and PCI DSS at the same time?
Largely, yes. All three expect a data inventory, risk assessment, access control, encryption, vendor oversight, training and incident response. Building those controls once and mapping them to each framework's specific requirements is far more efficient than running three separate efforts.
