compliance-testing

name	compliance-testing
description	Regulatory compliance testing for GDPR, CCPA, HIPAA, SOC2, PCI-DSS and industry-specific regulations. Use when ensuring legal compliance, preparing for audits, or handling sensitive data.
category	specialized-testing
priority	high
tokenEstimate	900
agents	["qe-security-scanner","qe-test-executor","qe-quality-gate"]
implementation_status	optimized
optimization_version	1
last_optimized	2025-12-02T00:00:00.000Z
dependencies	[]
quick_reference_card	true
tags	["compliance","gdpr","hipaa","pci-dss","ccpa","soc2","privacy","audit"]

Compliance Testing

<default_to_action> When validating regulatory compliance:

1. IDENTIFY applicable regulations (GDPR, HIPAA, PCI-DSS, etc.)
2. MAP requirements to testable controls
3. TEST data rights (access, erasure, portability)
4. VERIFY encryption and access logging
5. GENERATE audit-ready reports with evidence

Quick Compliance Checklist:

• Data subject rights work (access, delete, export)
• PII is encrypted at rest and in transit
• Access to sensitive data is logged
• Consent is tracked with timestamps
• Payment card data not stored (only tokenized)

Critical Success Factors:

• Non-compliance = €20M or 4% revenue (GDPR)
• Audit trail everything
• Test continuously, not just before audits </default_to_action>

Quick Reference Card

When to Use

• Legal compliance requirements
• Before security audits
• Handling PII/PHI/PCI data
• Entering new markets (EU, CA, healthcare)

Major Regulations

Regulation	Scope	Key Focus
GDPR	EU data	Privacy rights, consent
CCPA	California	Consumer data rights
HIPAA	Healthcare	PHI protection
PCI-DSS	Payments	Card data security
SOC2	SaaS	Security controls

Penalties

Regulation	Maximum Fine
GDPR	€20M or 4% revenue
HIPAA	$1.5M per violation
PCI-DSS	$100k/month
CCPA	$7,500 per violation

---

GDPR Compliance Testing

// Test data subject rights
(,  () => {
   response =  api.(, { userId });

  (response.).();
  (response..).();

   data =  (response..);
  (data).();
  (data).();
});

(,  () => {
   api.();

  
  ( db..({ : userId })).();
  ( db..({ userId })).();

  
  ( db..({ userId })).();
});

(,  () => {
   api.(, {
    userId, : , : ,
    :  (), : 
  });

   consent =  db..({ userId, :  });
  (consent.).();
  (consent.).();
});