128 Free Compliance Generators — No Account Required
ComplyKit has added two more free compliance generators, bringing the total to 128. Today's additions: the HIPAA Security Rule v2 Gap Assessment (127th) and the Brazil LGPD Compliance Checklist (128th).
HIPAA Security Rule v2 Gap Assessment (127th generator)
The HIPAA Security Rule (45 CFR Part 164 Subpart C) governs the protection of electronic PHI (ePHI) for all Covered Entities and Business Associates. In 2024, HHS issued the most significant proposed Security Rule update in 20 years, proposing mandatory MFA, asset inventories, 15-day critical patch timelines, and 72-hour breach notification. The HIPAA Security Rule v2 Gap Assessment covers 42 key obligations across six categories:
- Administrative Safeguards (§164.308): Security Officer designation and authority, risk analysis (comprehensive/documented/scope/threats/vulnerabilities/risk levels), risk management plan, workforce training (at hire and annually), access management procedures (authorization/establishment/modification/termination), contingency plan (backup/DR/emergency mode/annual testing), BAAs with all business associates and subcontractors
- Physical Safeguards (§164.310): Facility access controls with documented authorisation, workstation use policies (specified functions and physical attributes), workstation security (screen locks/cable locks/clean desk), device and media disposal (NIST 800-88 secure sanitisation), media movement tracking and accountability, physical audit logs and visitor controls for data centres, emergency physical access procedures
- Technical Safeguards (§164.312): Unique user IDs (no shared/generic accounts), automatic logoff after inactivity, AES-256 encryption at rest, TLS 1.2+ in transit, audit controls (login/access/create/modify/delete; 6-year retention), integrity controls (checksums/hashing), break-glass emergency access procedures
- HHS 2024 NPRM Requirements: Technology asset inventory (all ePHI-containing systems), network map (ePHI data flow diagram), vulnerability management (critical patches within 15 days), annual contingency plan testing (restore from backup), network segmentation, anti-malware/EDR on all ePHI systems, MFA for all ePHI access (proposed as required)
- Breach Notification Rule (§164.400–414): HHS notification within 60 days (proposed 72 hours), individual notification with substitute notice procedures, media notification for 500+ State/jurisdiction, four-factor breach risk assessment documentation, incident response plan (detection/containment/investigation/notification/recovery), breach register (6-year retention), annual Wall of Shame monitoring
- Privacy Rule & HIPAA Governance: Privacy Officer designation, NPP updated for 2024 Reproductive Health Privacy Rule, minimum necessary standard implementation, individual rights (access 30-day/amendment/accounting/restriction/confidential communications), BAA audit programme, OCR audit readiness programme, state law pre-emption analysis (42 CFR Part 2, CCPA/CMIA, state mental health laws)
Who it's for: Covered Entities (hospitals, physician practices, FQHCs, health plans, dental practices, pharmacies); Business Associates (EHR/EMR vendors, health tech SaaS platforms, cloud service providers storing ePHI, healthcare analytics companies, revenue cycle management firms, billing processors); digital health startups assessing HIPAA applicability; post-breach corrective action plan implementation teams; compliance teams preparing for OCR audit or investigation.
Brazil LGPD Compliance Checklist (128th generator)
Brazil's Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018) applies to any organisation processing personal data in Brazil or of Brazilians, regardless of company location or size. With 215 million people, a booming tech economy (São Paulo as Latin America's largest tech hub), and ANPD enforcement intensifying in 2026, LGPD compliance is essential for any business with Brazilian operations or customers. The Brazil LGPD Compliance Checklist covers 42 key obligations across six categories:
- Lawful Bases & Consent (Arts. 7–11): Legal basis documentation for every processing activity (10 LGPD bases), consent architecture (freely given/informed/unambiguous/specific purpose/highlighted clause), legitimate interest three-part test (not available for sensitive data), purpose limitation, sensitive personal data explicit consent (8 categories), children's data parental consent and best-interest principle, consent withdrawal as easy as giving without detriment
- Data Subject Rights (Arts. 18–22): 15-day response to confirm existence and access (simplified or full format), right to correction (third-party notification), right to anonymisation/blocking/deletion of non-compliant data, right to portability (interoperable format), right to information about sharing (list of entities received data), right to revoke consent (no detriment), rights intake channel free of charge with ANPD complaint escalation
- Controller Obligations (Arts. 37–43): Privacy/transparency notice with all Art. 9 elements in plain Portuguese, DPO/Encarregado designated with public identity and contact (mandatory — no thresholds), Records of Processing Activities (RoPA — Art. 37), data minimisation and necessity, retention schedule with automated deletion, processor (operador) contracts with LGPD-equivalent obligations, Privacy Impact Assessment (RIPD) for high-risk processing
- Security & Incident Notification (Arts. 46–51): Technical and administrative security measures appropriate to risk, incident detection and response capability, ANPD notification within 2 business days of discovery (Resolution CD/ANPD No. 4/2023), individual notification for relevant harm (ANPD may require broader), incident register (5-year retention) for ANPD inspection, anonymisation standards (ANPD guidance on irreversibility), post-incident root cause and improvement
- International Transfers (Arts. 33–36): Legal basis for each transfer (8 permitted bases), ANPD adequacy determination (separate from EU adequacy list), standard contractual clauses for non-adequate countries, BCRs for intra-group, specific consent with country and risk disclosure, international transfer inventory, sub-operator downstream transfer controls
- Governance & ANPD Enforcement (Arts. 50–55): LGPD compliance programme (Art. 50 — documented good-faith mitigating factor for ANPD sanctions), internal and external privacy policies in Portuguese, ANPD interaction protocol and designated contact, staff training on LGPD obligations, penalty risk management (up to 2% Brazil revenue capped at BRL 50M/violation), privacy by design and by default principles
Who it's for: Brazilian companies of any size (LGPD applies regardless of employee count or revenue); SaaS and tech companies with Brazilian users or customers; e-commerce and marketplace platforms serving Brazil; multinationals with Brazilian subsidiaries or Brazil data flows; financial services (with additional BACEN requirements); healthtech and digital health; legal and compliance teams building LGPD programmes or adapting existing GDPR programmes for Brazil; organisations that have received ANPD inquiries or complaints.
Browse all 128 generators
All 128 free compliance generators are at /generate. No account required. Covers GDPR, CCPA, SOC 2, HIPAA Security Rule, Brazil LGPD, ISO 27001/27701, EU AI Act (GPAI + High-Risk), NIS2, DORA, PSD2/PSD3, FCA Consumer Duty, CSRD, CRA, NIST CSF 2.0, NIST AI RMF, NIST SP 800-53 Rev 5, CMMC 2.0, Digital Markets Act, EU Data Governance Act, EU Data Act, ePrivacy, AI Fairness, SOC 2 Trust Services Criteria, US State Privacy Laws, APRA CPS 230, Singapore PDPA, India DPDP Act, Saudi Arabia PDPL, Australia Privacy Act 2024, Thailand PDPA, Japan APPI 2022, South Korea PIPA 2023, PCI DSS v4.0 SAQ-D, UAE PDPL, Canada PIPEDA / Bill C-27, and more.