Complying With United States New Privacy Laws

Many state privacy bills have been proposed in the past few years, but as of January 1, 2023, only five states had comprehensive privacy laws in effect: California Consumer Privacy Act (CCPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), and Virginia Consumer Data Protection Act (VCDPA). However, in 2023, there have been some impressive developments in the U.S. privacy landscape. Iowa passed the Consumer Data Protection Act (ICDPA), while the Indiana Consumer Data Protection Act (ICDPA) was passed by the Indiana Legislature, Montana’s Consumer Data Privacy Act (MCDPA) was unanimously approved by the Montana House of Representatives and Senate, and the Tennessee Information Protection Act (TIPA) was unanimously passed by the Tennessee House and Senate.

Other states are also making progress on their own comprehensive consumer privacy bills and specialized privacy laws, such as those focused on children, social media, and health information. The race is on to see which state will be next! Additionally, a federal privacy law is still a possibility. To this end, the Kiteworks Private Content Network (PCN) provides organizations with the assurance that their sensitive content is secure and compliant.

Get a Demo

Get Started

Enable Consumer Control Over Information

Numerous U.S. states have enacted privacy laws, such as the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (VCDPA), empowering individuals with control over their personal information, in line with the European Union’s General Data Protection Regulation (GDPR). To assist businesses in demonstrating compliance and adapting to this evolving landscape, the Kiteworks platform provides end-to-end encryption, secure access to personal data, and an immutable audit log for efficiently verifying data delivery and deletion processes.

Enforce and Prove Compliance

New U.S. state privacy laws increase consumer control over personal information and impose obligations on businesses. Transparency, consent, and data security measures are required, with the CCPA mandating privacy notices and consent for data collection and the VCDPA necessitating opt-in consent for sensitive data. Kiteworks’ PCN enables the secure sharing of sensitive content via email, file sharing, and more, offering end-to-end encryption, multi-factor authentication, and a virtual appliance. Audit logs and tracking ensure compliance with data privacy regulations.

Elevate Governance for Enhanced Privacy

Kiteworks’ comprehensive platform consolidates compliance risk and costs with advanced content governance across various communication channels, such as email, file sharing, automated file transfer, APIs, and web forms. It offers extensive visibility into information exchange, capturing audit trails and enabling file-level data analysis for centralized monitoring and archiving. This simplifies compliance validation while seamlessly integrating with DLP, ATP, and CDR services to guard against leaks and malware. ATP scanning, quarantine, and the CISO Dashboard enhance protection from zero-day threats, ensuring robust security for organizations.

Frequently Asked Questions

The California Consumer Privacy Act (CCPA) is a state data privacy law that regulates how certain businesses collect, use, and share personal information of California residents. The law applies to businesses that meet certain criteria, including having annual gross revenue of $25 million or more, collecting or selling personal information of more than 50,000 consumers, households, or devices, or deriving more than 50% of their annual revenue from selling personal information.

The Colorado Privacy Act (CPA) is a state data privacy law that sets new requirements for data controllers and processors that collect and process personal information of Colorado residents. The law includes provisions on data subject rights, controller obligations, data protection impact assessments, and data breach notification requirements. It also extends liability for data breaches to third-party processors and requires businesses to obtain consent before collecting sensitive data.

The Iowa Consumer Data Protection Act (ICDPA) is a state data privacy law that sets new requirements for businesses that collect, process, or share personal information of Iowa residents. The law includes provisions on data subject rights, controller obligations, data protection impact assessments, and data breach notification requirements. It also includes a provision for affirmative opt-in consent for the collection and sharing of certain sensitive information.

The Virginia Consumer Data Protection Act (VCDPA) is a state data privacy law that regulates how certain businesses collect, use, and share personal information of Virginia residents. The law applies to businesses that meet certain criteria, including having annual gross revenue of $25 million or more, collecting or selling personal information of more than 100,000 consumers, households, or devices, or deriving more than 50% of their annual revenue from selling personal information.

The Connecticut Data Privacy Act (CTDPA) is a state data privacy law that sets new requirements for data controllers and processors that collect and process personal information of Connecticut residents. The law includes provisions on data subject rights, controller obligations, data protection impact assessments, and data breach notification requirements. It also includes a provision for affirmative opt-in consent for the collection and sharing of certain sensitive information. Additionally, the CTDPA requires businesses to conduct regular risk assessments to ensure the security of personal information and to implement reasonable security measures to protect against unauthorized access, use, or disclosure of personal information.

The Utah Consumer Privacy Act (UCPA) is a new privacy law that was signed into law by Governor Spencer Cox on March 2, 2021. The UCPA gives Utah residents more control over their personal information and requires businesses to obtain consent from individuals before collecting or selling their personal data. The law also imposes data security and breach notification requirements on businesses that collect personal information. The UCPA went into effect on January 1, 2022.