Which regulatory frameworks are most relevant to telemetry data handling?

• A. HIPAA/HITECH, PCI where applicable, and state privacy laws; SOC 2 for vendors.
• B. GDPR is the only framework applicable in all contexts.
• C. HIPAA/HITECH, PCI where applicable, state privacy laws; SOC 2 for vendors; GDPR if EU context.
• D. No regulatory frameworks apply to telemetry.

Answer: (C)

Telemetry data handling sits at the intersection of privacy and security rules, and which regulations apply depends on what the data contains and where it’s processed. HIPAA/HITECH come into play when telemetry involves protected health information and the data is handled by covered entities or business associates, ensuring appropriate safeguards. PCI applies to any payment card data that might be part of the telemetry workflow. State privacy laws add jurisdiction-specific requirements that can vary widely and may impose additional protections. For working with vendors, SOC 2 is often used to demonstrate that the provider has effective controls over security, availability, processing integrity, confidentiality, and privacy. And if the data or processing occurs in the EU or involves EU residents, GDPR becomes applicable in that context. So the most comprehensive view is HIPAA/HITECH, PCI where applicable, state privacy laws; SOC 2 for vendors; GDPR if EU context.