A data warehouse concentrates an organization's most sensitive information - customer records, financial transactions, health data - in one place, which makes it the natural focus of regulatory compliance. Compliance requirements are the legal and contractual rules that govern how that data is collected, stored, accessed, retained, and deleted. They aren't optional features bolted on at the end; they shape the warehouse's design, from how columns are classified to who can run which query.
The major regimes
A handful of regulations drive most warehouse compliance work. GDPR (EU) grants individuals rights over their personal data, including access, correction, and erasure ("right to be forgotten"), and restricts cross-border transfer. CCPA/CPRA (California) gives similar consumer rights and disclosure obligations. HIPAA (US healthcare) governs protected health information with strict access, audit, and encryption rules. SOX (US public companies) requires controls and auditability over financial data. PCI DSS governs payment-card data. Each adds specific obligations, but they overlap heavily on a few themes: know what sensitive data you hold, control who touches it, prove it, and be able to delete it.
What compliance demands of the warehouse
Translated into design, the recurring requirements are: data classification (tagging which columns are PII, PHI, or financial so policy can attach to them), access control (role-based and often column- or row-level, so people see only what their role permits), encryption at rest and in transit, audit logging (who accessed what, when - the evidence regulators ask for), retention and deletion (keeping data only as long as allowed and being able to erase an individual's records), and data residency (keeping data in a permitted jurisdiction). Modern warehouses provide the primitives - masking policies, row-access policies, access history, tagging - but the rules themselves have to be defined and enforced deliberately.
Building it in, not bolting it on
Compliance is cheapest when it's part of the model. Classifying columns at ingestion, attaching masking and retention policies to those classifications, and recording access automatically means a compliance report is a query against metadata rather than a fire drill. The alternative - discovering during an audit that you can't say where customer email appears or can't delete a specific person's data - is the expensive path. This is exactly where data lineage, retention policies, and data stewardship stop being abstract governance ideas and become the machinery that keeps you compliant.
Frequently asked questions
Which regulations most affect data warehouses? Commonly GDPR, CCPA/CPRA, HIPAA, SOX, and PCI DSS - depending on your data and jurisdiction - overlapping on classification, access control, auditability, and deletion.
What is the "right to be forgotten"? A GDPR right letting individuals request erasure of their personal data, which the warehouse must be able to honor - a real design constraint, not a checkbox.
How do warehouses support compliance technically? Through data classification/tagging, column- and row-level access policies, encryption, audit/access logging, and retention controls.
Why build compliance into the model? So reporting and deletion are routine metadata operations rather than manual audits - discovering gaps during an audit is far more costly.