Data governance for HIPAA / GDPR / SOC 2 compliance on the lakehouse

Summary

• Data governance for HIPAA, GDPR, and SOC 2 comes down to the same repeatable controls: fine-grained access control, classification of sensitive data, complete audit logs, end-to-end lineage, and policies that follow data through its lifecycle.
• These frameworks differ in wording but ask similar questions about who can access data, how it's protected, how long it's kept, and where it flows, so a governance layer earns its keep by producing that evidence from data you already hold.
• On the lakehouse, Unity Catalog provides these controls as one governance layer for data and AI across AWS, Azure, and Google Cloud, so evidence comes from the platform rather than manual collection.
• Compliance is a shared responsibility: the platform supplies controls and evidence, while meeting a given regulation still depends on your configuration, your processes, and agreements such as a HIPAA business associate agreement.
• Databricks maintains attestations including SOC 2 Type II and ISO 27001, and offers a Compliance Security Profile for workloads subject to standards such as HIPAA, which support your program without, on their own, making you compliant.

Data governance for HIPAA / GDPR / SOC 2 compliance on the lakehouse

Data governance for these frameworks has one job: control who uses sensitive data, protect it, and prove both on demand. The controls that deliver it stay the same regardless of the regulation: fine-grained access control, automatic classification of sensitive data, complete and queryable audit logs, end-to-end lineage, and policies that follow data through its lifecycle. HIPAA, GDPR, and SOC 2 differ in wording but ask similar questions about access, protection, retention, and traceability. On the lakehouse, Unity Catalog provides these controls as one governance layer for data and AI, so evidence comes from the platform. Compliance stays a shared responsibility: these controls support your obligations, they don't replace your own configuration and processes.

What HIPAA, GDPR, and SOC 2 ask of data governance

Each framework frames the ask differently, but the governance work overlaps. HIPAA calls for safeguards on protected health information, with access restricted and logged, and it requires a signed business associate agreement before that data is processed. GDPR expects you to know where personal data lives, limit access to lawful use, and answer data subject requests about an individual's data. SOC 2 asks you to demonstrate security and access controls with evidence gathered over time. The common thread is proof: showing with records, not assertions, who accessed what, how it was protected, and where it flowed.

Key capabilities to evaluate

Capability	What it supports
Fine-grained access control	Restricting who can read or change data at the catalog, schema, table, column, and row level.
Sensitive data classification	Finding and tagging PII, financial, and credential data so protections can follow it.
Dynamic masking and row filtering	Showing different users appropriate views of the same table without copying data.
Complete audit logs	Producing a queryable record of access and administrative actions as audit evidence.
End-to-end lineage	Tracing where a data element came from and where it flows, which supports data subject requests.
Retention and lifecycle policy	Governing how long data is kept and how it is handled over time.
Governance for AI	Extending the same controls and audit trail to models, features, and agents.
Consistent policy across clouds	Applying one set of controls across environments so gaps do not open between them.

How Databricks approaches governance for compliance on the lakehouse

Unity Catalog applies a define-once, secure-everywhere model across AWS, Azure, and Google Cloud, so a policy set in one place applies across workspaces and personas.

• Fine-grained access control. SQL-standard permissions apply at the catalog, schema, table, and column levels, with row filters and column masking enforced in the engine. Attribute-based access control applies masking and filtering from data classifications and user attributes, so a rule follows the data automatically.
• Automatic classification. Sensitive data such as PII, financial information, and credentials is detected and tagged at the column level, and those tags drive protection policies directly. See automated governance with ABAC, tags, and classification.
• Auditing as evidence. System tables and user-level audit logs record access, queries, and administrative actions, so teams can show who accessed what and when.
• Automatic lineage. Column-level lineage is captured with no manual instrumentation, which helps answer where a person's data lives and where it flows downstream, a recurring need for data subject requests.
• Governance for AI. Models, features, metrics, and agents are governed as first-class assets, and Unity Gateway applies access control, audit logging, and observability to model endpoints and MCP servers.

Databricks maintains a compliance program that includes SOC 2 Type II and ISO 27001 attestations, and it offers a Compliance Security Profile that adds a baseline of controls for workloads subject to standards such as HIPAA and PCI-DSS. Processing protected health information under HIPAA requires a signed business associate agreement and a properly configured workspace. These controls help organizations meet obligations under HIPAA, GDPR, and SOC 2, though the specific evidence, scope, and configuration depend on each organization's requirements. See the security, compliance, and privacy overview and the Databricks Trust Center.

FAQs

Does Unity Catalog make my lakehouse HIPAA, GDPR, or SOC 2 compliant?

No. It provides the controls and evidence, including access control, classification, masking, audit logs, and lineage, that support those frameworks. Compliance is a shared responsibility that also depends on your configuration, your processes, and agreements such as a HIPAA business associate agreement.

How does the lakehouse support GDPR data subject requests?

Automatic column-level lineage and classification help you find where a person's data lives and trace where it flows, while fine-grained access control and masking limit who can see it.

Where does compliance evidence come from on Databricks?

From the platform itself. Audit logs and system tables, lineage, and classification tags are captured automatically, so much of what an auditor asks for is already recorded rather than assembled by hand.

Does compliance extend to AI on the lakehouse?

Yes. When models and agents read regulated data, they fall under the same obligations. Governing AI assets in the same system as data, with Unity Gateway applying access control and audit logging to model endpoints, keeps the trail consistent across both.