State Privacy Laws
What is State Privacy Laws?
Data protection regulations enacted by individual US states to protect residents' personal information, each with varying requirements and rights.
Terms that appear alongside state privacy laws
Each of these is named in at least one of the same controls as state privacy laws. The number is how many controls name both.
- gdpr 24 shared controls
- ccpa 21 shared controls
- hipaa 15 shared controls
- compliance 14 shared controls
- glba 12 shared controls
- consent 11 shared controls
- data subject 11 shared controls
- nist 10 shared controls
Frameworks that govern state privacy laws
What the standards actually require on state privacy laws
Requirements naming state privacy laws across 6 standards, quoted from the control text.
Per Iowa Code 715D.8 + 715D.9 ICDPA enforcement is exclusively vested in the Iowa Attorney General with no private right of action and offers the LONGEST cure period among US state privacy laws (90 days vs 30 days in Virginia/Indiana/Utah + 60 days original in...
ICDPA-Enforcement-90DayCure-AttorneyGeneralOnly-NoPrivateRight-CivilPenalties-7500-PerViolation-Longest-Cure · Iowa CDPA Enforcement - Attorney General Exclusive + 90-Day Cure Period (LONGEST among US State Privacy Laws) + No Private Right of Action + Civil Penalties Up to USD 7500 Per Violation →FCC CPNI rules + Section 222 of the Communications Act are the principal US federal telecommunications-privacy framework. Status: REGULATIONS IN FORCE since 1996 (Section 222) + 1998 (initial FCC CPNI Order) + 2007 + 2009 + 2011 + 2017 amendments.
CPNI-Status · FCC CPNI - corpus status, enforcement landscape, broadband privacy →Apply Communicate-P function including: Communication Policies (CM.PO-P) covering policies for privacy communications + records of disclosures + privacy notice strategy;
NISTPF-4 · Communicate-P - Privacy Notice, Transparency, and Individual Awareness →Honour PII data subject rights including: right of access + rectification + erasure/correction + portability + restriction of processing + objection + automated decision-making protections per Privacy Act 1974 access and amendment + state privacy laws + GDPR e...
NISTSP122-3 · PII Data Subject Rights and Automated Decision-Making →Apply Section 6 data classification and handling in cloud per FIPS 199 categorisation + agency data sensitivity + GDPR + CCPA + 24 state privacy laws + HIPAA + PCI DSS + SOX.
NISTSP144-3 · Data Classification, Handling, and Sovereignty →Conduct retail-tailored risk assessment + customer data inventory + classification per the NRF framework + NIST SP 800-30 Rev 1 + adaptation to retail threat model.
NRFCS-2 · Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model →Questions people ask about state privacy laws
What is State Privacy Laws?
Why is State Privacy Laws important for compliance?
Which compliance frameworks address State Privacy Laws?
Where can I learn more about State Privacy Laws?
See how State Privacy Laws applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.