GLBA: Gramm-Leach-Bliley Act - Federal legislation governing data privacy requirements for financial institutions
HIPAA: Health Insurance Portability and Accountability Act - Federal legislation protecting sensitive patient health information from being disclosed without consent
COPPA: Children's Online Privacy Protection Act - Federal legislation imposing requirements on operators of websites or online services directed to children under 13 years of age
FTC Act Section 5: Federal Trade Commission Act Section 5 - Prohibits unfair or deceptive practices in privacy and data security matters
CCPA/CPRA: California Consumer Privacy Act/California Privacy Rights Act - State legislation providing California residents with rights over their personal information
VCDPA: Virginia Consumer Data Protection Act - State legislation providing Virginia residents with data privacy rights and imposing obligations on businesses
CPA: Colorado Privacy Act - State legislation establishing privacy rights for Colorado residents and requirements for businesses processing their personal data
CTDPA: Connecticut Data Privacy Act - State legislation providing Connecticut residents with various privacy rights and establishing business obligations
UCPA: Utah Consumer Privacy Act - State legislation establishing privacy rights for Utah residents and obligations for businesses processing personal data
GDPR Compliance: General Data Protection Regulation considerations when handling EU residents' data, even if primarily operating in the US
PIPEDA Compliance: Personal Information Protection and Electronic Documents Act considerations when handling Canadian residents' data
Data Processing Scope: Clear definition of what personal data will be processed, how it will be processed, and for what purposes
Security Measures: Technical and organizational measures required to ensure appropriate level of data security
Breach Notification: Requirements and timeframes for reporting data breaches to relevant parties
Data Subject Rights: Procedures for handling data subject requests including access, deletion, and portability
Cross-border Transfers: Requirements and safeguards for transferring personal data across international borders
Audit Rights: Provisions allowing data controller to audit data processor's compliance with privacy obligations
Subprocessor Management: Requirements for engaging and managing subprocessors, including notification and approval processes
Data Retention: Specifications for how long data can be retained and procedures for secure deletion
Confidentiality: Obligations to maintain confidentiality of processed personal data and training requirements for staff
