packets.build
Data privacy is the legal layer: whose personal data, which statute, which rights. Compliance operations is the calendar: evidence, vendors, access reviews, questionnaires, incidents. This hub merges those because a 40-person AI company cannot afford two departments. ISO 42001 still does not replace GDPR, DPDP, CCPA, or HIPAA. ISO 27001 still does not pick a lawful basis. Run them as one owner graph.
Packets' ICP is Indian B2B SaaS selling to US and EU accounts. That usually means DPDP plus GDPR or UK GDPR plus whatever US state or sector rule the buyer triggered. AI systems make the operations half harder because prompts and fine-tunes are processing.
Data privacy: the statutes that actually show up
GDPR applies extra-territorially when you offer services to people in the EU/EEA or monitor them. Text: EUR-Lex. CCPA/CPRA is California thresholds, opt-out of sale or share: California AG. HIPAA is PHI and business associates, not a general badge: HHS. India's DPDP Act covers digital personal data linked to India. Do not assume GDPR work satisfies DPDP.
Product entries: GDPR, HIPAA. Comparison cluster: later GDPR-vs-CCPA post. Hub sibling: what comes after SOC 2 for framework sequencing.
Compliance operations: the loop
Inventory processing and AI systems together. Keep a vendor list you can update. Recertify access. Sample logs. Answer questionnaires from evidence, not from memory. Internal audit and management review if you run ISO 27001 or ISO 42001. That loop is compliance management and evidence automation on the software side, and a specialist on the human side.
GRC software stores the objects. Operations fail when nobody owns exceptions. Packets' model: implementation. Tool-only: Packets vs Scrut.
Where ISO 42001 and ISO 27001 plug in
Personal data in models is both a privacy fact and an AIMS fact. Security of processing is an ISMS fact. Map deletion and access into the same tickets. Do not run a privacy wiki, a 27001 wiki, and a 42001 wiki. Guides: ISO 27001, ISO 42001 certification, AI governance.
What to stand up first
- Processing inventory with residency and controller/processor role.
- AI inventory with data-for-AI notes.
- Rights-request path that can reach prompts and tickets.
- Vendor intake when someone adds an LLM.
- A monthly operations review with named owners.
Score gaps: free audit score.
Frequently asked questions
If we buy GRC software, is data privacy done?
No. Software does not choose lawful bases or sign BAAs.
Does ISO 42001 count as a privacy certificate?
No. It can document how AI systems use data. Statutes still apply.
Is a public security page the same as operations?
A public security page is a communications artifact. Operations are the reviews behind it.
How do we start this week?
List EU, California, and India data principals you actually have. Contact Packets if you need that turned into a program. Related: B2B SaaS and end-to-end compliance.
