GDPR HIPAA CCPA Compliance

I need an experienced security professional to bring our organisation fully in line with GDPR, HIPAA and CCPA. My immediate priorities are strengthening data-encryption practices, tightening access controls and formalising an incident-response process. The end goal is clear: demonstrable, audit-ready compliance.

Current status
• A mix of on-prem and cloud workloads (M365, AWS) with basic policies in place.
• No formal gap analysis, limited documentation, and no rehearsed breach-response run-book.

What I’m expecting from you
1. Conduct a comprehensive compliance gap assessment across our systems and third-party services.
2. Design and, where possible, implement technical controls for encryption at rest/in transit, role-based access and log monitoring.
3. Draft or refine required documents—DPIA, HIPAA BAA, CCPA notices, incident-response playbook—and map them to each regulation.
4. Train my small IT team so we can sustain the controls after hand-off.
5. Deliver a final compliance report with evidence, remediation checklist and an executive-level summary.

All work must respect the exact wording of the regulations, be traceable, and withstand external audit. Cloud-native tooling (AWS KMS, Azure Key Vault, M365 Compliance Center), SIEM integration and any open-source or commercial solutions you recommend are welcome, provided licensing implications are spelled out.

If you’ve guided organisations through successful GDPR, HIPAA or CCPA audits before, let’s talk. I am ready to start as soon as we agree on scope and milestones.