Privacy law increasingly imposes affirmative security duties rather than only notification duties after the fact. This hub covers what regulators mean by reasonable security and the disclosure rules now attaching to incidents.
Data Security Rules
November 9, 2026
Article 2A of Chapter 75, the Identity Theft Protection Act, goes further than breach notice. Section 75-62 limits how a business may display, transmit, mail or sell Social Security numbers, section 75-64 sets rules for destroying records, and each section makes a violation a violation of G.S. 75-1.1. The two differ on private suits and on treble damages.
Read more →
Data Security Rules
November 9, 2026
South Carolina added Chapter 99 to Title 38 through 2018 Act No. 171, signed May 3, 2018 and effective January 1, 2019, and its Department of Insurance describes it as the first enactment of the NAIC data security model. The chapter tracks the model closely, so its interest lies in the places where the wording, the timing and the later amendments part from it.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
Breach Notification
October 26, 2026
House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →
Data Security Rules
October 19, 2026
On December 20, 2024 the FTC issued its final complaint and decision and order against Marriott and Starwood, Docket No. C-4807, alleging deceptive and unfair data security behind three breaches between 2014 and 2020. The order mandates a specified security program, biennial outside assessments, deletion requests and loyalty point restoration for 20 years.
Read more →
Data Security Rules
October 5, 2026
Customer proprietary network information is the record of whom a phone customer calls, when, for how long and on what plan. Section 222 of the Communications Act limits how carriers use it, and the FCC's rules in subpart U of part 64 add a two-tier customer approval system, password and ID checks before disclosure, and an officer-signed compliance certificate filed every March 1.
Read more →
Breach Notification
October 5, 2026
In December 2023 the FCC rewrote its carrier breach rule to reach personally identifiable information and inadvertent exposures, add itself as a recipient, and swap a mandatory waiting period for a 30-day limit. Those amendments still await an effective date, and on July 31, 2026 the Sixth Circuit vacated the panel decision upholding the order.
Read more →
Breach Notification
October 5, 2026
Florida's breach statute is section 501.171, created in 2014 by CS/CS/SB 1524 as the Florida Information Protection Act. It pairs a duty to take reasonable security measures with two 30-day notice clocks, one to residents and one to the Department of Legal Affairs at 500 people, and it treats a violation as a FDUTPA unfair practice with per-breach civil penalties capped at $500,000.
Read more →
Data Security Rules
September 28, 2026
Senate Bill 227 of 2009 was introduced as an encryption rule and enacted with a payment card clause: a Nevada data collector that accepts cards follows the current PCI Data Security Standard for those transactions, and other data collectors encrypt personal information leaving their control. A 2011 bill widened the device rule, and 2025 bills renamed the office that approves other methods.
Read more →
Data Security Rules
September 21, 2026
The Justice Department launched the Civil Cyber-Fraud Initiative on October 6, 2021 to pursue government contractors and grantees under the False Claims Act for knowing cybersecurity failures. This publication located sixteen resolved matters announced in DOJ releases through September 1, 2026, totaling about $69.1 million. Every one settled, and most began as whistleblower suits.
Read more →
Data Security Rules
September 14, 2026
The NAIC adopted its Insurance Data Security Model Law in late 2017 as a template for state legislatures. It asks insurance licensees to run a written information security program, oversee vendors, investigate cybersecurity events and notify the insurance commissioner within 72 hours. This walks through the model's text and compares it with eight enacted state versions.
Read more →
Data Security Rules
September 14, 2026
The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb.
Read more →
HIPAA
September 1, 2026
In January 2025 the Office for Civil Rights proposed rewriting the HIPAA Security Rule, retiring the addressable safeguard category and adding asset inventories, encryption, multi-factor authentication and annual compliance audits. Nothing has been finalised, and the Unified Agenda now carries the rulemaking as a long-term action.
Read more →
GLBA
August 24, 2026
The Gramm-Leach-Bliley Act splits its privacy and security duties across several regulators, and the FTC's share lands on non-bank businesses that rarely call themselves financial institutions. This guide works through 16 CFR Part 314 as written: the coverage test, the nine enumerated elements, the exemption for smaller holders and the reporting duty that took effect in 2024.
Read more →
HIPAA
August 12, 2026
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of risks to electronic protected health information. The requirement recurs across HHS Office for Civil Rights resolution agreements more than almost any other provision. This sets out what the regulation says and how OCR has described the standard.
Read more →