2018 saw a surge of state data security legislation, including
by Alabama, Arizona, California, Colorado, Iowa, Louisiana,
Nebraska, Ohio, Oregon, South Carolina, South Dakota, Vermont and
Virginia. These laws are intended to enhance and strengthen
existing data protection guidelines and, in some cases, are modeled
after existing standards, such as the European Union’s
General Data Protection Regulation. These new (or amended)
regulations set minimum data security requirements and practices
for businesses that collect and process personal data.
Additionally, they identify breach notification time periods,
broaden the definitions of “personal information” and
add safeguards with regard to the information of minors. Other
notable changes include, in the case of Colorado and Nebraska,
requirements to flow down appropriate security measures to service
providers receiving personal information.
