Gramm-Leach-Bliley Act (GLBA): Federal law that requires financial institutions to protect customer financial data and explain their information-sharing practices
Health Insurance Portability and Accountability Act (HIPAA): Federal law governing the protection and privacy of protected health information (PHI)
Federal Trade Commission Act (FTC Act): Broad federal consumer protection law that prohibits unfair or deceptive practices, including those related to data privacy and security
Children's Online Privacy Protection Act (COPPA): Federal law that imposes requirements on operators of websites or online services directed to children under 13 years of age
Fair Credit Reporting Act (FCRA): Federal law that regulates the collection, dissemination, and use of consumer credit information
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): State law providing California residents with enhanced privacy rights and consumer protection for their personal data
Virginia Consumer Data Protection Act (VCDPA): State law establishing framework for controlling and processing personal data of Virginia residents
Colorado Privacy Act (CPA): State law providing Colorado residents with data privacy rights and imposing obligations on data controllers and processors
Utah Consumer Privacy Act (UCPA): State law establishing privacy rights for Utah consumers and regulatory requirements for businesses processing personal data
Connecticut Data Privacy Act (CTDPA): State law providing Connecticut residents with various privacy rights and establishing obligations for businesses handling personal data
NIST Cybersecurity Framework: Voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk
Payment Card Industry Data Security Standard (PCI DSS): Information security standard for organizations that handle branded credit cards from major card schemes
General Data Protection Regulation (GDPR): EU regulation that may apply when handling data of EU residents, establishing strict requirements for data protection and privacy
