Stop 12 · Security & Accessibility TestingTopics · 7/7

Compliance Testing Overview

In short

In banking, health or any app handling personal data, 'it works' isn't enough. It must also follow specific laws and standards, and you need proof that someone checked.

Verifying a system meets specific regulatory or industry requirements (like GDPR data handling or accessibility mandates) — a specialized testing focus in regulated industries.

The purple blob in an inspector's cap checks a fire extinguisher in a restaurant kitchen.

Think of it like this

The fire safety inspection

A restaurant can serve great food and still be shut down if the fire extinguisher is expired. The inspector checks a fixed list and wants records. Compliance testing checks your app against rules like that, and keeps the evidence.

Watch it happen

Common compliance areas a tester meets

Compliance

Data privacy

Accessibility

Card payments

GDPR, DPDP Act

Consent, delete

WCAG level AA

PCI DSS

No cards in logs

1/5Which rules apply depends on your industry and where your users live.

The big ideas

What you need to know

Rules come from outside

Requirements come from laws, standards and contracts, not just the product team's wishes.

Traceability

Link each rule to the test cases that check it, so you can show exactly how it was tested.

Keep evidence

Auditors want proof: test results, dates, screenshots and who signed off. Store them properly.

Work with experts

Legal and security teams interpret the rules. QA turns them into clear, testable checks.

How it works

From a legal rule to audit evidence

1
Read the requirement
Example: users must be able to delete their account and personal data.
2
Write test cases
Delete an account, then check the profile, orders and email list no longer hold their data.
3
Run and record
Execute the cases and save results, screenshots and dates.
4
Link and sign off
Link results to the requirement ID so an auditor can follow the trail.

Save yourself the pain

Common mistakes

Oops

Assuming the legal team handles compliance, so QA can skip it.

Do this instead

Legal defines the rule, but someone must test that the app follows it. That's often QA.

Oops

Testing compliance features but not keeping any records.

Do this instead

In compliance work, untested and undocumented look the same to an auditor. Keep the evidence.

Your mission

Test a privacy right

~30 min

Quick check

Your app takes card payments. Which check is a classic compliance test?

Go deeper

1Research a compliance standard relevant to an industry you're interested in.
2Learn how a specific technical requirement (like data deletion) maps to a compliance obligation.
3Understand this is a specialized QA niche, most relevant in finance, healthcare, and government sectors.