Ten regulations, answered from one index
Every regime opens with the same two questions, which are what personal data you hold and who can reach it. GEODI answers them once against the systems you run, then reports in whichever form the reviewer asks for.
- Markets
- Canada / United States / Mexico
- Regulations mapped
- 10
- Regulation content
- 35+ countries
- Evidence
- Generated from the live index
- Certification
- Stays your own program
Coverage across North America
A mark records that GEODI performs that function against data in scope. It does not record that your organization is compliant, which stays the outcome of your own program.
| Regulation | Market | Find | Label | Mask | Access | Evidence |
|---|---|---|---|---|---|---|
| PIPEDA | Canada | Yes | Yes | Yes | Yes | Yes |
| Quebec Law 25 | Canada | Yes | Yes | Yes | Yes | Yes |
| PHIPA | Ontario | Yes | Yes | Yes | Yes | Yes |
| FIPPA and MFIPPA | Canada, public sector | Yes | Yes | n/a | Yes | Yes |
| HIPAA | United States | Yes | Yes | Yes | Yes | Yes |
| CCPA and CPRA | California | Yes | Yes | Yes | Yes | Yes |
| GLBA | United States | Yes | Yes | Yes | Yes | Yes |
| SOX | United States | Yes | Yes | n/a | Yes | Yes |
| LFPDPPP | Mexico | Yes | Yes | Yes | Yes | Yes |
| PCI DSS | Cross-border | Yes | Yes | Yes | Yes | Yes |
Obligations by market
PIPEDA
Safeguards matched to sensitivity, and a response to individual access requests.
Quebec Law 25
An inventory of personal information, destruction or anonymization once the purpose ends, and assessment before disclosure outside Quebec.
PHIPA
Limits on who reaches personal health information held by a custodian.
FIPPA and MFIPPA
Records inventories for provincial and municipal institutions, answered on a statutory clock.
HIPAA
Protected health information located, access restricted to the minimum necessary, activity recorded.
CCPA and CPRA
Consumer requests to know and to delete, answered across every system holding the record.
GLBA
Customer financial information identified and protected under the safeguards rule.
SOX
Control evidence over financial records, produced from live data rather than reconstructed.
LFPDPPP
Personal data identified across holdings, with security measures proportionate to sensitivity.
ARCO rights
Access, rectification, cancellation and opposition requests answered from a single index.
Residency
Processing kept inside the country where policy or contract requires it.
Compliance stays a program run by people
What software removes is the excuse that nobody could find the data.
Inventory
Which systems hold regulated data, by category and volume.
Classification
How each item was labelled and against which rule.
Access
Who could reach sensitive content at a point in time.
Actions
What was masked, moved or removed, by which account.
Requests
Subject access responses with the source path for every hit.
Bring the clause you have to satisfy
We walk your regulatory scope against the deployment and say plainly which parts the software covers, and which parts stay with your program.