HumenhukCIPP/US Study Guide
Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws

Breach Laws: Covered Entities

Reviewed by Victor Humenhuk. Published . Reviewed .

Most states cover entities that conduct business in the state and maintain computerized data containing personal information. Georgia is a notable outlier, limiting covered entities to information brokers.

How this supports CIPP/US study

Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.

Most state laws cover those who (1) conduct business in the state and (2) in the ordinary course of business maintain computerized data that includes personal information. Some states limit coverage to those conducting business in that state.

Georgia outlier

Georgia significantly narrows coverage, defining covered entities as information brokers - not all businesses. An ordinary retailer may fall outside Georgia's law even though it would be covered in most other states.

Key terms - quick answers

What is “Covered entity (breach law)”?
An entity subject to a state breach law, typically one that does business in the state and maintains computerized personal information.
What is “Information broker (Georgia)”?
Georgia's narrow definition of covered entity, limiting the breach law to businesses whose primary purpose is furnishing personal information to nonaffiliated third parties.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.