Compliance Frameworks: What They Are and What They Ask From Your Data

Key takeaways

• A framework is a system, not a checklist: it organizes laws, regulations, and standards into one repeatable set of controls and the evidence that proves them.
• Frameworks, regulations, and standards differ: regulations are legally binding; frameworks and standards are the structures organizations adopt to meet and evidence them.
• Version currency matters in 2026: ISO/IEC 27001:2022 is the only valid version, PCI DSS 4.0.1’s future-dated requirements are fully in force, and NIST CSF 2.0 added the Govern function, focusing on how enterprises manage cybersecurity risk.
• Every framework asks the same core things of your data: residency, encryption, access control, lineage and audit trails, and retention. The work is architectural, not procedural.

What is a compliance framework?

A compliance framework is a structured set of policies, controls, and processes an organization uses to meet the requirements of laws, regulations, and industry standards. Instead of treating each obligation separately, a framework organizes them into one repeatable system: what to protect, which controls to apply, and how to prove it.

That last part—proof—is where frameworks become a data problem. Certifications and audits are won or lost on evidence, such as access records, encryption status, data lineage, and retention logs. This guide focuses on the frameworks that govern data, security, and privacy, and approaches each one from the perspective of the teams who have to make enterprise data comply.

Compliance frameworks vs. regulations vs. standards

The three terms are used interchangeably, but they are different instruments. Knowing which is which tells you what is legally required versus what is created to help satisfy those requirements.

Type	What it is	Examples
Regulation	Legally binding rules issued by governments; non-compliance carries penalties.	GDPR, HIPAA, CCPA/CPRA, EU AI Act
Framework	A structured, often certifiable system of controls for meeting obligations.	SOC 2, NIST CSF, FedRAMP
Standard	A formal published specification, typically from a standards body.	ISO/IEC 27001:2022, PCI DSS

In everyday usage, “compliance framework” covers all three. Organizations adopt frameworks and standards to demonstrate they meet regulations. The distinction matters most for data compliance programs, where regulations define what must be true of the data and frameworks define how you operationalize and evidence it.

The major compliance frameworks in 2026

Several common frameworks have changed materially in the last two years, and most ranking guides haven’t caught up. Here are the ones most enterprises encounter, as they stand in 2026.

SOC 2

An AICPA attestation framework built on the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 2 produces an auditor’s report rather than a certificate. For data teams, it means demonstrable access controls, encryption, monitoring, and change management over the systems that hold customer data.

ISO/IEC 27001:2022

The international standard for information security management systems. The 2022 revision is now the only valid version. Certificates to the 2013 edition were withdrawn at the October 2025 transition deadline, with Annex A consolidated to 93 controls. Its data obligations span classification, access control, cryptography, and logging.

NIST CSF 2.0

The U.S. NIST Cybersecurity Framework, voluntary and widely adopted and reorganized in version 2.0 around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The added Govern function pulls data governance, roles, and policy into the framework’s core rather than its periphery.

PCI DSS 4.0.1

The payment card industry’s data security standard. All of version 4’s future-dated requirements have been fully in force since April 1, 2025, raising the bar on authentication, encryption of stored cardholder data, and continuous monitoring. Its data mandate is strict minimization: keep only the cardholder data you must, segment it, and restrict access to need-to-know.

HIPAA

The U.S. health-data regulation featuring a Security Rule that function as a de facto framework for electronic protected health information (ePHI), including administrative, physical, and technical safeguards, access controls, audit logs, and breach notification. Healthcare data platforms are effectively HIPAA evidence systems.

GDPR

The EU’s data-protection regulation—which is a law, not a framework—is the anchor of most privacy programs. It requires lawful basis and consent, data-subject rights (access, rectification, erasure), minimization, and controls on cross-border transfers. Upper-tier fines for violations reach up to 4% of global annual turnover or €20 million from the preceding financial year, whichever amount is higher. Frameworks such as ISO/IEC 27701 operationalize it.

FedRAMP

The U.S. federal authorization program for cloud services, built on NIST controls and continuous monitoring, and recently modernized under its 20x initiative. Cloud providers serving federal data must hold authorization. For more on how the program now works, see Teradata’s guide to FedRAMP.

What is cloud security compliance?

At its core, cloud security compliance is the practice of meeting security-focused frameworks and regulations in cloud environments, along with proving that data stored and processed in the cloud is protected to the standard the framework requires. It sits inside the broader discipline of cloud compliance and inherits the cloud’s shared-responsibility model.

That shared-responsibility split is the defining feature. The cloud provider secures the infrastructure, while the customer remains responsible for data, such as classification, access, encryption keys, and configuration. With cloud compliance, frameworks cover both, even though the evidence comes from different layers.

What is data security compliance?

Data security compliance means meeting the requirements that frameworks and regulations place on the data itself, wherever it lives. It is data-centric rather than system-centric and covers everything from classifying sensitive data and controlling who can access it to encrypting data in transit and at rest, logging every touch, and retaining or deleting it on schedule.

The distinction is important as data moves. A record can be compliant in one system and exposed in the next. Mature programs therefore attach controls to the data layer. These policies follow the data across environments, instead of rebuilding controls application by application.

AI compliance frameworks: The new wave

A new generation of frameworks now governs how organizations build and run AI. And nearly all of their requirements focus on data governance. In practice, AI compliance frameworks are data governance frameworks with a model attached.

ISO/IEC 42001

The first certifiable management-system standard for AI, published in 2023. It applies the ISO management-system pattern to AI, covering risk assessment, impact analysis, lifecycle controls, and continuous improvement. It includes governance of the data used to train and operate models.

NIST AI RMF

A voluntary U.S. framework for trustworthy AI organized around four functions: Govern, Map, Measure, and Manage. Data teams are responsible for managing many of its practical demands, including provenance, quality measurement, bias evaluation, and documentation of the datasets behind each model.

EU AI Act

The EU’s AI law, with obligations phasing in through 2026 and beyond. It started with prohibitions, then added general-purpose model duties from August 2025. A broader regime that includes high-risk system requirements applied beginning in 2026. For high-risk AI, it mandates data governance directly, training data quality, relevance, and documentation.

What compliance frameworks require from your data

Strip away each framework’s vocabulary and a common core remains. Nearly every framework above asks the same central components of enterprise data. Audits are passed by proving them continuously, not annually.

Residency and sovereignty

Where data physically lives, and which jurisdiction’s law applies. GDPR restricts transfers; FedRAMP requires authorized environments; sector and national rules increasingly require in-country processing. Architecture must make location a controllable, provable property of the data.

Encryption and access control

Encryption in transit and at rest, key management, and least-privilege access—the requirement every framework shares, from SOC 2’s security criteria to PCI DSS’s cardholder-data rules to HIPAA’s technical safeguards. The evidence is the access log, rather than a policy document.

Lineage, audit, and retention

Who touched which data, where it came from, how it was transformed, and how long it is kept. Lineage answers the auditor’s “prove it” obligation. Retention and deletion schedules answer minimization requirements. And audit trails turn compliance from an annual event into a queryable property of the platform.

One data platform, many frameworks

Most enterprises are in scope for several frameworks at once. SOC 2 for customers, ISO/IEC 27001:2022 for global operations, GDPR and HIPAA by jurisdiction and sector, and PCI DSS for payments. Implemented separately, that means duplicated controls, overlapping audits, and inconsistent answers.

The alternative is to deploy the common control core once, at the data platform layer. That means unified access control, encryption, lineage, quality rules, and retention policies applied where the data lives, letting each framework consume the same evidence. One governed data estate, many attestations. This is the data-layer version of unified control mapping, and it is the difference between compliance as a recurring project and architecture-inherent compliance.

How to choose the right compliance framework

Framework selection is mostly determined for you by industry, jurisdiction, customers, and the data you hold. The choices that remain are sequencing and depth.

Industry	Typical frameworks	What it means for your data
Healthcare	HIPAA, ISO/IEC 27001:2022	ePHI access controls, audit logs, breach-ready lineage.
Financial services	SOX, PCI DSS, ISO/IEC 27001:2022, DORA (EU)	Cardholder-data minimization, integrity controls, operational-resilience evidence.
SaaS and technology	SOC 2, ISO/IEC 27001:2022, GDPR	Customer-data access evidence, encryption, data-subject rights fulfillment.
Public sector	FedRAMP, NIST CSF 2.0	Authorized environments, continuous monitoring, U.S. data residency.
Retail and e-commerce	PCI DSS, GDPR/CCPA	Payment-data segmentation, consent and preference enforcement.

Three questions test whether your data estate is audit-ready before any framework project starts:

• Can you locate and classify the sensitive data in scope?
• Can you produce access and lineage evidence for it on demand?
• Can you enforce residency, retention, and deletion where the data lives?

If any answer is no, the framework gap exists in the architecture.

How do compliance frameworks support data sovereignty?

Compliance frameworks complement data sovereignty by turning jurisdictional requirements into enforceable controls. That includes residency rules that keep data in-country, access policies that respect local law, transfer mechanisms for cross-border movement, and audit evidence that proves all three. Sovereignty defines where and under whose law the compliance applies. Frameworks define how you comply and how you demonstrate it.

How Teradata supports compliance-ready data

Teradata’s approach is to make compliance a property of the data platform. Teradata Cloud carries independent attestations that enterprises rely on, including ISO/IEC 27001:2022 and SOC 2 Type 2 lineage dating back to 2016, IRAP PROTECTED assessments for government-grade workloads across AWS, Azure, and Google Cloud, and FedRAMP-ready status for U.S. federal environments. While platform capabilities supply the evidence frameworks demand, such as fine-grained access control, encryption, lineage, quality rules, and retention enforced where the data lives. For organizations with strict residency or sovereignty requirements, Teradata Factory extends the same platform to private, on-premises deployments.

Explore data certifications and compliance to discover how Teradata adheres to industry standards and regulatory policies.

Frequently asked questions