This is not legal advice
This guide is a general engineering and operations overview. Applicability and obligations depend on facts and jurisdiction. Please involve your counsel and privacy or security officer.
Scope and who is covered
| GDPR | HIPAA | |
|---|---|---|
| Applies to | Personal data of people in the EU, EEA or UK, and organizations that offer services to or monitor them | US covered entities (health plans, many healthcare providers, clearinghouses) and their business associates handling protected health information |
| Data | Any personal data, with extra rules for special categories such as health | Protected health information |
| Platform role | Processor (customer data) and controller (own data) | Business associate |
Consent, basis and authorization
GDPR allows several lawful bases for processing; consent is one, and it must be specific, informed and withdrawable. HIPAA uses permitted uses and disclosures, and requires an authorization for some uses, notably many marketing uses of protected health information. Neither replaces telemarketing or call-recording laws, which add their own consent rules by channel and place.
Individual rights
GDPR grants access, rectification, erasure, restriction, portability and objection rights, with a general response time of one month. HIPAA grants access, amendment, restrictions and an accounting of disclosures, handled through the covered entity. A platform should support both by making data findable and exportable, including recordings, transcripts and derived data.
Breach notification
Under GDPR, controllers generally must notify the supervisory authority within 72 hours of becoming aware of a breach, and processors must notify controllers without undue delay. Under HIPAA, business associates notify covered entities without unreasonable delay and no later than 60 days after discovery, and contracts often require less. A single incident process that starts every applicable clock at detection avoids missed deadlines.
Retention and deletion
GDPR’s storage-limitation principle pushes toward deleting data when no longer needed. HIPAA requires certain documentation to be retained for six years. These can pull in different directions, so retention rules should be defined by data category, with legal holds and documented exceptions.
AI-specific points
- Automated decisions: GDPR Article 22 limits solely automated decisions with significant effects, so keep a person in the loop for high-impact outcomes.
- Minimum necessary: send AI providers only the fields needed; under HIPAA, only providers under a business associate agreement should receive PHI.
- Recordings and transcripts: these can contain special-category or health data; default them to off unless needed.
- No training on customer data without explicit agreement.
When both apply
Apply the stricter control for each topic: the shorter notification clock, the more restrictive provider routing, the narrower access. Keep consent, authorization and channel consent as separate records so you never infer one from another.