FTC Act: Federal Trade Commission Act - Primary federal law governing unfair or deceptive practices affecting commerce, including data privacy and security practices
Privacy Act of 1974: Federal law establishing a code of fair information practices governing the collection, maintenance, use, and dissemination of personal information maintained by federal agencies
HIPAA: Health Insurance Portability and Accountability Act - Provides data privacy and security provisions for safeguarding medical information
GLBA: Gramm-Leach-Bliley Act - Requires financial institutions to explain their information-sharing practices and protect sensitive data
COPPA: Children's Online Privacy Protection Act - Imposes requirements on operators of websites or online services directed to children under 13 years of age
FCRA: Fair Credit Reporting Act - Regulates the collection, dissemination, and use of consumer information, including consumer credit information
CCPA/CPRA: California Consumer Privacy Act/California Privacy Rights Act - Comprehensive state privacy laws giving California residents control over their personal information
VCDPA: Virginia Consumer Data Protection Act - Comprehensive privacy law providing Virginia residents with rights regarding their personal data
CPA: Colorado Privacy Act - Provides Colorado residents with privacy rights and imposes obligations on businesses processing their personal data
CTDPA: Connecticut Data Privacy Act - Establishes privacy rights for Connecticut residents and requirements for businesses processing their personal data
UCPA: Utah Consumer Privacy Act - Provides privacy rights to Utah residents and regulates how businesses handle their personal information
GDPR: General Data Protection Regulation - EU law on data protection and privacy that may apply to US companies handling EU resident data
Standard Contractual Clauses: Pre-approved contractual language by the European Commission that provides appropriate safeguards for international data transfers
Privacy Shield Framework: Principles providing guidance for data transfers between the EU/UK and United States, though currently invalid for EU transfers
NIST Cybersecurity Framework: Voluntary guidance developed by the National Institute of Standards and Technology to help organizations manage cybersecurity risks
ISO 27001: International standard for information security management systems, providing requirements for establishing, implementing, and maintaining security controls
PCI DSS: Payment Card Industry Data Security Standard - Security standards designed to ensure companies that accept, process, store or transmit credit card information maintain a secure environment
