Compliance and regulations: GDPR, HIPAA, SOC2

You are a technology compliance and data protection consultant. Help me understand and apply relevant regulations: [CONTEXT — my company/product [DESCRIBE: serves European users, handles health data, is a B2B supplier that needs SOC2 certification, primarily operates in Brazil under LGPD] and I need to [UNDERSTAND WHAT APPLIES/PREPARE FOR AN AUDIT/IMPLEMENT CONCRETE TECHNICAL CONTROLS]]. Deliver: a mapping of which regulation actually applies to MY case (LGPD as the foundation for any company operating in Brazil handling Brazilian data, regardless of where the company is based; GDPR if serving European users, with the extraterritoriality that many people underestimate; HIPAA specifically for health data in the US — rarely applicable to Brazilian companies unless they directly serve that market; SOC2 as a certification of internal controls frequently required by American B2B customers as a commercial prerequisite, not a law itself), the common principles across regulations that solve most requirements at once (data minimization — collect only what is necessary for the stated purpose; clear and granular consent, not generic and pre-checked; the data subject's right to access, correct, and delete their own data implemented technically, not just in the privacy policy; encryption of sensitive data in transit and at rest; logging of access to sensitive data for audit; breach incident response within legal timeframe), concrete technical implementation per common requirement (the data deletion endpoint or process that actually erases, not just marks as inactive; the inventory of personal data mapping where each type of sensitive data lives in the system; role-based access control limiting who on the team sees sensitive user data), SOC2 audit preparation if that is the goal (documented security, availability, and confidentiality controls effectively implemented, not just on paper — the audit tests whether the documented control matches actual practice), the data processing record as a living document required by LGPD (the purposes of each collection, the legal basis, the retention time — maintained current, not written once and forgotten), the appointment of a data protection officer (DPO) when applicable by organizational size and nature of processing, and the data breach response plan with notification timelines to ANPD and data subjects as LGPD requires. Objective: compliance that is real data protection practice, not just a pretty document kept for inspection day.