SOC 2, ISO, GDPR, HIPAA, FINRA: which data room compliance box do you actually need? (2026)

Data room compliance is the set of security attestations, certifications, and legal obligations that govern how a virtual data room handles the documents you put in it. Five frameworks cover almost every deal: SOC 2, ISO 27001, GDPR, HIPAA, and the financial recordkeeping rules enforced by FINRA and the SEC.

Quick recap

• Data room compliance splits into two categories: attestations and certifications a vendor holds, and legal obligations that apply to you regardless of which vendor you use.
• SOC 2 is an AICPA attestation reported on by a CPA firm. Type II covers a 6 or 12 month audit window and is the standard enterprise requirement.
• ISO 27001 is a genuine certification of an information security management system, issued by an accredited body on a three-year cycle with annual surveillance audits.
• GDPR is European law, not a badge. What a buyer needs from a vendor is a data processing agreement, a sub-processor list, a transfer mechanism, and a named hosting region.
• HIPAA applies to protected health information in the United States and turns on a signed business associate agreement rather than a certificate.
• FINRA Rule 4511 and SEC Rule 17a-4 govern books and records for broker-dealers, requiring preservation for at least six years in a compliant format with indexed, prompt retrieval.
• A vendor certification never covers your configuration. Stale counterparty access is the most common finding in deal-side security reviews and no attestation addresses it.
• Papermark is SOC 2 Type II, ISO 27001, GDPR, HIPAA, and CCPA compliant, with EU hosting in Frankfurt available; SOC 2 Type II sits on the Data Rooms Plus plan at €249/month.
• Datasite, Intralinks, and iDeals publish SOC 2 and ISO 27001 postures; DocSend is a document-tracking product whose compliance documentation runs through its Dropbox parent.

Compliance is where data room procurement goes slowest, and usually for the wrong reason. Teams spend three weeks collecting certificates and then configure the room in a way that would fail any of the frameworks they just verified. This guide covers what each of the five frameworks actually requires, how the major providers compare, and where the responsibility sits on your side rather than the vendor's.

Start 7-day data room trial

No credit card required.

1. What data room compliance actually means

There are two entirely different things people mean by data room compliance, and conflating them is the source of most wasted procurement time.

The first is vendor compliance: what the operator of the platform has been audited or certified against. SOC 2 and ISO 27001 live here. They tell you about the company holding your documents, how it controls access to production systems, how it encrypts data, how it manages change, and how it responds when something goes wrong. This is the part a certificate or a report can evidence.

The second is transaction compliance: the legal obligations attaching to the documents themselves. GDPR, HIPAA, and financial recordkeeping rules live here. These follow the content, not the platform. If your diligence set contains employee records for 210 people in Germany, GDPR applies whether your vendor holds four certifications or none, and it applies to how you share those records as much as to how the vendor stores them.

The practical consequence is that a compliant data room is a combination, never a single purchase. You need a vendor whose platform-level controls are attested, and you need a configuration and a process that satisfy the law governing the content. Buying the most certified vendor on the market and then granting nine bidders download rights over the HR folder fails the second test completely.

The third thing worth saying plainly is that compliance frameworks are not ranked. ISO 27001 is not better than SOC 2, and a vendor with both is not twice as secure as one with either. They are different instruments answering different questions for different markets, and which one your counterparty asks for is mostly a function of where that counterparty is based.

2. SOC 2: the North American baseline

SOC 2 is an attestation standard from the American Institute of Certified Public Accountants. An independent CPA firm examines a service organisation's controls against the Trust Services Criteria and issues a report. There is no certificate and no public registry, so the only way to verify a SOC 2 claim is to read the report, normally provided under NDA.

The five Trust Services Criteria are security, availability, processing integrity, confidentiality, and privacy. Only security, the Common Criteria, is mandatory. For a data room the criteria that matter are security, confidentiality, and availability; processing integrity rarely applies because a VDR serves documents rather than computing values.

Type I attests to how controls were designed at a single date. Type II attests that they operated effectively across a period, usually 6 or 12 months, and is what enterprise procurement means when it asks the question. Type I typically takes a few weeks to a few months to issue; Type II typically takes 6 to 12 months from kickoff. Our dedicated guide to the SOC 2 compliant data room covers the report structure, bridge letters, and the nine questions to put to a vendor.

The single most useful habit in vendor review is to ask for the audit period dates in the first email. It costs nothing, it is answered in one line by any vendor that genuinely holds a report, and it filters out marketing claims before a call is booked.

3. ISO 27001: the international certification

ISO 27001 certifies an information security management system against an international standard. Unlike SOC 2 it is a true certification: an accredited certification body audits the organisation and issues a certificate with a defined scope and expiry, on a three-year cycle with surveillance audits in between.

The distinction that matters commercially is scope. An ISO 27001 certificate names the part of the organisation and the services it covers, and a vendor can be certified for its corporate IT without the certificate extending to the product you are buying. Read the scope statement on the certificate rather than the logo on the website, and check the expiry date, because certificates lapse.

Geographically, ISO 27001 carries more weight in Europe, the Middle East, and Asia, while SOC 2 dominates in North America. European counsel and German or Nordic corporates frequently ask for ISO 27001 first. American enterprise procurement frequently asks for SOC 2 Type II first. Vendors selling into both markets tend to hold both, and vendors selling into one often hold one, which is a commercial fact rather than a security judgement.

For a data room buyer, the sensible position is to treat either as an acceptable platform baseline unless a specific counterparty has specified otherwise, and to spend the saved time on the transaction-level obligations in the next three sections, where the actual exposure usually sits.

4. GDPR: the framework that is law, not a badge

GDPR is the one that catches deal teams out, because there is nothing to collect. No body certifies GDPR compliance. It is European law, it applies continuously, and it attaches to personal data wherever that data sits.

Almost every diligence set contains personal data. Employment contracts, payroll files, an org chart with names, customer lists for a B2C business, CVs of key management, and the shareholder register are all personal data under GDPR. The moment those documents enter a data room shared with bidders, you are a controller disclosing personal data to third parties, and your vendor is a processor.

Two of those rows are the ones that actually go wrong. The first is data minimisation: sellers routinely upload full employment contracts including salary and personal address when a redacted schedule would satisfy the buyer entirely. The second is retention: rooms stay open for months after completion with counterparty access still live, which is precisely the situation a supervisory authority would characterise as processing without a purpose.

EU hosting is the pragmatic answer to the transfer question. If the data never leaves the European Economic Area, the international transfer analysis largely disappears, which is why so many European sellers specify a Frankfurt or EU region as a hard requirement. Our guide to GDPR compliance at Papermark covers the vendor-side instruments in detail.

5. HIPAA: protected health information in a deal room

HIPAA governs protected health information in the United States, and it applies to a much wider set of transactions than people expect. Any acquisition of a healthcare provider, a health insurer, a medical device business with patient registries, a digital health application, or a clinical research organisation will put PHI into the diligence set.

Like GDPR, HIPAA is law rather than a certificate. What a data room buyer needs from a vendor is a signed business associate agreement, under which the vendor accepts direct obligations for the safeguards around PHI. A vendor that will not sign a BAA cannot host PHI, regardless of what else it holds. A vendor that will sign one has accepted regulatory exposure, which is why the question separates serious providers from general file-sharing tools quickly.

The operational controls HIPAA expects map cleanly onto data room features: access controls limiting PHI to the minimum necessary, audit controls recording activity, integrity controls, transmission security, and the ability to terminate access. In practice a compliant configuration means PHI sits in its own folder, that folder is view-only and watermarked, access is granted to named individuals rather than to a domain, and every open is logged.

The mistake to avoid is treating de-identification as optional. Most buy-side diligence questions about a healthcare target can be answered with aggregate or de-identified data, and where they can, putting identifiable records into a room shared with nine bidders is exposure taken on for no commercial benefit.

6. FINRA, SEC Rule 17a-4, and financial recordkeeping

Broker-dealers, investment banks, and the advisory arms of financial institutions carry recordkeeping obligations that most deal teams have never read. FINRA Rule 4511 requires members to make and preserve books and records as required under FINRA rules and the Exchange Act, and those records must be preserved for at least six years in a format and on media that comply with SEC Rule 17a-4.

Rule 17a-4 is the specific one, and it is prescriptive. Records must be preserved in a non-rewriteable, non-erasable format, commonly described as WORM, meaning write once read many. They must be indexed so they can be located, they must be retrievable promptly, and they must be accessible to regulators on request. A general cloud storage folder does not satisfy those conditions by default.

For most sellers and most advisers, the practical implication is narrower than the rule sounds. You are not asking the data room vendor to be your regulated archive. You are asking it to produce, at completion, an immutable and indexed export of exactly what was disclosed and to whom, which you can then place into whatever archive your compliance function operates. A room that can freeze and export with an index and an access log covers that; a shared drive does not.

7. How five major data room providers stack up

The table below sets out the published compliance posture of the five providers buyers most often compare. Two notes before reading it. First, none of these entries substitutes for asking the vendor for current documentation, because scopes and expiry dates change. Second, the absence of a framework is frequently a market decision rather than a security one.

The more useful comparison for most buyers is not which logos a vendor displays, but what it costs to reach the tier where the compliance features live. Certifications describe the platform. Audit logs, Q&A permissions, and file indexing are the features that let you evidence your own compliance, and vendors differ enormously in what they charge for them.

Papermark places SOC 2 Type II and the visitor audit log on Data Rooms Plus at €249/month with 5 team members. Datasite, iDeals, and Intralinks are custom-quote products where the equivalent capability sits inside a five-figure annual engagement. DocSend is a document-tracking product rather than a diligence VDR, and its data room features are lighter on permissions and Q&A. If you are working through the wider provider set, our comparison of the best virtual data rooms covers pricing model and bidder management alongside compliance.

8. Worked scenario: a healthcare services sale under four regimes

Halstead Care is a hypothetical UK healthcare services group with US operations, being sold to a European private equity buyer. The diligence set runs to 740 documents, and four different regimes apply to different parts of it, which is a more common situation than the single-framework framing in most vendor marketing suggests.

The security lead maps the set before the room opens. Around 210 documents contain personal data of employees and contractors, engaging UK GDPR and the EU GDPR for the German subsidiary. Ninety-five documents from the US operation contain protected health information, engaging HIPAA and requiring a business associate agreement with the data room vendor. Sixty documents are financial records held by the group's regulated advisory affiliate, carrying a six-year preservation obligation. The remaining 375 are ordinary commercial documents with no special regime beyond the confidentiality undertakings in the NDA.

740documents

• General commercial, NDA only375 · 51%

  Contracts, corporate records, commercial diligence
• Personal data, UK and EU GDPR210 · 28%

  Employment files, payroll, org charts, shareholder register
• Protected health information, HIPAA95 · 13%

  US operation, business associate agreement required
• Regulated financial records, 6 year retention60 · 8%

  Advisory affiliate books and records

Worked scenario. The point of the exercise is that a single room holds four different compliance obligations, so a single permission set cannot satisfy all of them.

The build follows the map. The 95 PHI documents go into their own folder, view-only, watermarked, restricted to four named reviewers on the buyer's clinical diligence team. The 210 personal-data documents are redacted to remove salaries and home addresses before upload, then restricted to counsel. The 60 regulated records stay out of the bidder-facing room entirely and are disclosed through a separate link to the buyer's regulatory adviser, with the export earmarked for the advisory affiliate's archive.

At completion the room is frozen and exported with an index and the full access log. Three months later the buyer's counsel asks whether a specific clinical services agreement was disclosed before signing. The export answers it in four minutes, with a timestamp and a named viewer, which is the entire reason the exercise was worth doing.

9. Common data room compliance mistakes

The most common mistake is collecting certificates and stopping. A vendor's SOC 2 report and ISO 27001 certificate say nothing about whether your HR folder is open to nine bidders, and that configuration is what a supervisory authority or a counterparty's security team will actually look at.

The second is leaving access live after a counterparty exits. A bidder who withdrew in March and can still open the room in September is the single most frequent finding in deal-side reviews, and it is entirely a process failure rather than a platform one. Link expiry set at creation solves it without anyone having to remember.

The third is uploading unredacted personal data because redaction is tedious. Data minimisation is a GDPR principle, not a nice-to-have, and a redacted schedule answers nearly every buy-side question that a full employment contract answers.

The fourth is treating the room as an archive. Live rooms are not immutable, and a regulated firm's six-year retention obligation is not satisfied by leaving a folder open. Freeze, export with an index, and hand it to whoever runs your archive.

The fifth is asking for compliance features and then buying a plan that does not include them. Audit logs and permissioned Q&A are the two features that turn a policy into evidence, and on most platforms they sit above the entry tier. Check which plan carries them before signing.

10. Data room for your compliance requirements

A data room for compliance has to do more than sit on a platform with the right attestations. It has to let you demonstrate what you did: who saw which document, under what restriction, for how long, and what happened when the process ended.

Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available). Papermark is SOC 2 Type II compliant, covering the security, availability, and confidentiality Trust Services Criteria, and is ISO 27001, GDPR, HIPAA, and CCPA compliant, with AES-256 encryption at rest, TLS in transit, and EU hosting in Frankfurt available. The full posture is on the security page.

A data room for compliance is organised by sensitivity, so permissions can follow the regime rather than the department.

Why you need a data room for compliance

Certificates describe the vendor; logs describe you. When a counterparty's security team or a supervisory authority asks a question, the answer is never the vendor's SOC 2 report. It is a record of which named viewer opened which document, on what date, from what address, and whether they were able to download it. A data room for compliance produces that record automatically; a shared drive produces a link-access count.

Four regimes need four permission sets. A single diligence set routinely carries GDPR personal data, sector regulation, and ordinary commercial material at once, as the Halstead Care scenario shows. One permission set cannot satisfy all of them, and hand-picking documents per counterparty does not scale past two parties.

Data minimisation and retention are settings, not intentions. Link expiry, view-only defaults, watermarking, and instant revocation turn two GDPR principles into configuration rather than into things somebody has to remember to do in month five.

The record has to outlive the deal. Six-year retention obligations, disputes surfacing two years after signing, and warranty claims all depend on an immutable export made at completion. If you are still choosing a platform, our comparison of the best virtual data rooms covers where each provider's compliance features sit on its plan ladder.

Step 1: map documents to regimes before you upload anything

Sort the diligence set by the regime that governs it rather than by the department that produced it. Personal data, sector-regulated material, regulated financial records, and general commercial documents each get their own folder. This half-day of work is what makes every later permission decision obvious, and it is the artefact you hand to counsel when they ask how the room was structured.

Automatic file indexing on Data Rooms Plus maintains the index as documents arrive in waves, which is how diligence sets actually land.

Step 2: set permissions per regime, per counterparty

Granular file-level permissions are configured per link rather than per user account, so each party carries its own folder scope, email allowlist or domain restriction, and download rule over the same underlying room. No counterparty has to create an account, and the audit record is unaffected.

The regulated folder goes to two named reviewers; the general folder goes to all nine bidders, on one room.

Step 3: apply the restrictions the regime requires

Set the personal-data and sector-regulated folders to view-only, switch on dynamic watermarking so every page carries the viewer's email, IP address, and timestamp as it renders, and add screenshot protection where the exposure justifies it. Use link expiry and email verification so access ends on a date rather than when somebody remembers.

Watermarking is what makes a confidentiality restriction evidenceable rather than merely stated.

Step 4: keep the disclosure record in one place

Run questions through the Q&A module rather than email, so each question attaches to the document that prompted it and permissions control which group sees which threads. The log exports for the closing file, which is the difference between being able to answer what was disclosed and when, and reconstructing it from four inboxes.

Step 5: freeze, export, and archive

Page-level analytics and the visitor audit log capture every view, download, and NDA acceptance. At completion, data room freeze makes the room immutable and produces an archived ZIP with a certificate and an index, which is the artefact that satisfies a retention obligation and answers a dispute two years later.

The exportable visitor audit log is the compliance artefact, not the vendor's certificate.

What it costs

The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data rooms, unlimited documents, a custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module with permissions, the visitor audit log, automatic file indexing, a dedicated account manager, and SOC 2 Type II. Data Rooms Premium at €549/month covers 10 team members plus full API access, SSO, whitelabeling, and advanced security controls. A custom tier adds self-hosted deployment and a bring-your-own AWS bucket for teams that need the data on their own infrastructure.

For most compliance-driven requirements, Data Rooms Plus is the tier that matters, because the audit log and permissioned Q&A are the two features that turn your process into evidence.

Create your 7-day free trial

FAQ

Related resources

• Best virtual data rooms in 2026
• Papermark data room
• SOC 2 compliant data room
• Papermark SOC 2 Type II compliance
• Papermark GDPR compliance
• Data room security checklist
• NDA compliance in a virtual data room
• Data room checklist for 2026