State Data Security Laws
About two-thirds of states require data security measures. Roughly 20 states use a 'reasonable security' standard (e.g., California's AB 1950); about 10 impose prescriptive requirements (Massachusetts is the most prescriptive); and Connecticut, Iowa, Ohio, and Utah use safe harbor laws instead.
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.
Less well known than breach laws, state data security laws require companies to develop and maintain appropriate data security. Federally, no law imposes security standards across all industries, but the health care and financial sectors have federal security provisions, and the FTC uses its Section 5 power to challenge misrepresented security (deceptive) or a failure to provide reasonable procedures (unfair).
| Approach | Roughly how many states | Example |
|---|---|---|
| Reasonable security standard (no specifics) | ~20 states | California AB 1950 |
| Prescriptive/extensive requirements | ~10 states | Massachusetts (most prescriptive: authentication, access controls, encryption, monitoring, firewalls, updates, training) |
| Cybersecurity safe harbor instead of obligations | 4 states | Connecticut, Iowa, Ohio, Utah |
Some states impose sector-specific security mandates (e.g., financial services, insurance). New York has the most prominent of these.
Key terms - quick answers
What is “AB 1950”?
What is “Cybersecurity safe harbor law”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.