compliance-testing

Compliance Testing

<default_to_action> When validating regulatory compliance:

1. IDENTIFY applicable regulations (GDPR, HIPAA, PCI-DSS, etc.)
2. MAP requirements to testable controls
3. TEST data rights (access, erasure, portability)
4. VERIFY encryption and access logging
5. GENERATE audit-ready reports with evidence

Quick Compliance Checklist:

• Data subject rights work (access, delete, export)
• PII is encrypted at rest and in transit
• Access to sensitive data is logged
• Consent is tracked with timestamps
• Payment card data not stored (only tokenized)

Critical Success Factors:

• Non-compliance = €20M or 4% revenue (GDPR)
• Audit trail everything
• Test continuously, not just before audits </default_to_action>

Quick Reference Card

When to Use

• Legal compliance requirements
• Before security audits
• Handling PII/PHI/PCI data
• Entering new markets (EU, CA, healthcare)

Major Regulations

Regulation	Scope	Key Focus
GDPR	EU data	Privacy rights, consent
CCPA	California	Consumer data rights
HIPAA	Healthcare	PHI protection
PCI-DSS	Payments	Card data security
SOC2	SaaS	Security controls

Penalties

Regulation	Maximum Fine
GDPR	€20M or 4% revenue
HIPAA	$1.5M per violation
PCI-DSS	$100k/month
CCPA	$7,500 per violation

---

GDPR Compliance Testing

// Test data subject rights
test('user can request their data', async () => {
  const response = await api.post('/data-export', { userId });

  expect(response.status).toBe(200);
  expect(response.data.downloadUrl).toBeDefined();

  const data = await downloadFile(response.data.downloadUrl);
  expect(data).toHaveProperty('profile');
  expect(data).toHaveProperty('orders');
});

test('user can delete their account', async () => {
  await api.delete(`/users/${userId}`);

  // All personal data deleted
  expect(await db.users.findOne({ id: userId })).toBeNull();
  expect(await db.orders.find({ userId })).toHaveLength(0);

  // Audit log retained (legal requirement)
  expect(await db.auditLogs.find({ userId })).toBeDefined();
});

test('consent is tracked', async () => {
  await api.post('/consent', {
    userId, type: 'marketing', granted: true,
    timestamp: new Date(), ipAddress: '192.168.1.1'
  });

  const consent = await db.consents.findOne({ userId, type: 'marketing' });
  expect(consent.timestamp).toBeDefined();
  expect(consent.ipAddress).toBeDefined();
});