Watson Health Quality and Compliance Program

GDPR (EU)
As part of the European Union's General Data Protection Regulation (GDPR), IBM is enhancing its ongoing commitment to privacy by design. IBM is working to embed data protection principles even more deeply into its business processes. This work also strengthens existing controls to limit access to personal data, including mobile applications that rely on default settings to prevent sharing of personal data.

LGPD
The LGPD (Lei Geral de Proteção de Dados Pessoais) comes into effect in August 2020 and is a statutory law on data protection and privacy in the Federative Republic of Brazil. The law's primary aim is to unify 40 different Brazilian laws that regulate the processing of personal data.

CCPA
The California Consumer Privacy Act (CCPA) is a state-wide data privacy law that regulates how businesses all over the world are allowed to handle the personal information (PI) of California residents.

IBM works with local, state, national and international regulations based on the customer’s requirements. Please contact the Compliance Department for other regions that are covered.

ISO
The International Organization for Standardization (ISO) is an independent, non-governmental organization with a membership of 164 national standards bodies. ISO develops international standards that are voluntary, consensus-based and market relevant. The goal is to ensure that products and services are safe, reliable and of good quality.

ISO 9001
An international standard dedicated to Quality Management Systems (QMS). It outlines a framework for improving quality and provide products and services that consistently meet the requirements and expectations of customers. The QMS is a combination of all the processes, resources, assets, and cultural values that support the goal of customer satisfaction and organizational efficiency.

ISO 13485
This standard specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements.

ISO 27001
This standard defines the best practices for information security management processes. The ISO 27001:2013 standard specifies the requirements for establishing, implementing and documenting Information Security Management Systems (ISMS) controls.

ISO 27017
This standard provides guidelines for information-security controls applicable to the provisioning and use of cloud services as well as implementation guidance for both cloud service providers and cloud service customers.

ISO 27018
This standard establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in accordance with the privacy principles in ISO 29100 for the public cloud computing environment.

SOC
The System and Organization Controls (SOC) framework, developed by the American Institute of Certified Public Accountants (AICPA), is a standard for controls that protect information stored in the cloud. Certified public accountants (CPAs) audit cloud service providers (CSPs), which results in internal control reports on the services provided by a service organization. SOC reports can help users assess and address the risks associated with an outsourced service.

CFR
Title 21 CFR Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the United States Food and Drug Administration (FDA) regulations on electronic records and electronic signatures (ERES).

Title 21 CFR Part 820 outlines the current good manufacturing practice (CGMP) guidelines for developing medical devices. It governs the methods, facilities and controls used for medical device design, manufacture, packaging, labeling, storage, installation and service.

ICH GCP
A standard for the design, conduct, performance, monitoring, auditing, recording, analyses, and reporting of clinical trials that provides assurance that the data and reported results are credible and accurate as well as that the rights, integrity, and confidentiality of trial subjects are protected.