Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM At least twelve US states have enacted comprehensive privacy laws, and that number will reach twenty within two to three years. The laws share a common pattern — consumer rights to access, delete, correct, and opt out — but vary in scope, definitions, timelines, and
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM All 50 states and DC have data breach notification laws requiring you to notify affected individuals, and often regulators, within specific timeframes after discovering a breach. The laws differ in timing, content, recipient requirements, and penalties — meaning a multi-state breach requires managing
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPP/E, CIPM GDPR applies to any US company processing personal data of EU residents — regardless of where you're located, incorporated, or host servers. Fines reach 4% of global annual revenue or 20 million euros, whichever is higher. Enforcement is active and
Compliance Frameworks
Reviewed by Danielle Vargas, CIPP/US, CIPM CPRA replaced key parts of the original CCPA in 2023, expanding consumer rights, broadening the definition of personal information, and creating a dedicated enforcement agency. Any for-profit business collecting data from California residents is likely in scope. Penalties run $2,500-$7,