{"head":{"title":"Compliance Guides for Software Teams | OceanLab","description":"Plain-English guides to HIPAA, GDPR, PCI DSS, DORA, PSD2, MiCA, the EU MDR, Part 11 and more for software teams: duties, controls and official sources.","canonical":"https://oceanlab.in/compliance"},"items":[{"label":"HIPAA","href":"/compliance/hipaa","detail":"What the HIPAA Privacy, Security and Breach Notification Rules ask of a product that handles US health data, and the engineering controls that make it possible to meet them.","count":8},{"label":"SOC 2","href":"/compliance/soc-2","detail":"What a SOC 2 report is, why customers ask for one and which engineering controls auditors look at, from access reviews to change management.","count":9},{"label":"GDPR","href":"/compliance/gdpr","detail":"What the GDPR asks of software that handles personal data of people in the EU, from lawful basis and data rights to privacy by design, breach notice and transfers.","count":140},{"label":"PCI DSS","href":"/compliance/pci-dss","detail":"What PCI DSS asks of any system that touches card data, how to keep that system as small as possible, and the controls inside it.","count":32},{"label":"EU AI Act","href":"/compliance/eu-ai-act","detail":"How the EU AI Act sorts AI systems by risk, what providers and deployers must do in each tier, and when each part applies.","count":16},{"label":"21 CFR Part 11","href":"/compliance/21-cfr-part-11","detail":"What the FDA asks of software that keeps regulated records or takes electronic signatures, from audit trails and validation to how a signature is linked to its record.","count":6},{"label":"EU MDR","href":"/compliance/eu-mdr","detail":"When software counts as a medical device in the EU, how Rule 11 sets its class, and what a manufacturer must do before and after the product reaches patients.","count":9},{"label":"FHIR and HL7","href":"/compliance/fhir-hl7","detail":"How health systems exchange data today: HL7 v2 messages inside hospitals, FHIR APIs between apps, and the US rules that make FHIR access a requirement.","count":8},{"label":"DORA","href":"/compliance/dora","detail":"What the EU Digital Operational Resilience Act asks of financial firms and their technology providers: managing ICT risk, reporting major incidents on a clock, testing, and controlling third-party providers.","count":8},{"label":"MiCA","href":"/compliance/mica","detail":"How the EU's Markets in Crypto-Assets Regulation licenses crypto-asset service providers, what it asks of issuers and custody, and how the travel rule changes every transfer.","count":4},{"label":"PSD2","href":"/compliance/psd2","detail":"How the EU's second Payment Services Directive shapes login and checkout with strong customer authentication, opens bank accounts to licensed third parties, and sets who pays when a payment was not authorised.","count":21}]}