US DPO cheat sheet

The US has no single comprehensive federal privacy statute; protection comes from a patchwork of sectoral federal laws, FTC Act Section 5 unfair/deceptive practice enforcement, state statutes, and constitutional/sector rules.

FTC Act Section 5 prohibits unfair or deceptive acts or practices in or affecting commerce; the FTC enforces privacy promises as deception and inadequate security as unfairness, and lacks general civil penalty authority for first violations.

The Privacy Act of 1974 governs federal agencies' handling of records retrievable by personal identifier and grants individuals access, amendment, and disclosure-accounting rights.

The Fourth Amendment protects against unreasonable government searches; third-party doctrine limits protection for data voluntarily shared with providers, while Carpenter v. United States (2018) carved out CSLI.

Sectoral federal statutes map to data types: GLBA (financial), HIPAA (health), FERPA (education), COPPA (children under 13), FCRA (consumer reports), VPPA (video), CAN-SPAM (email), TCPA (calls/texts).

COPPA requires verifiable parental consent before collecting personal information from children under 13 and imposes data minimization and retention limits on operators.

HIPAA Privacy and Security Rules apply to covered entities and business associates; breach notification under the HITECH Act requires notification within 60 days of discovery.

FCRA regulates consumer reporting agencies: permissible purpose, accuracy, dispute investigation within 30 days, and adverse action notices to consumers.

Comprehensive state laws (e.g., CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA) typically apply to businesses over thresholds and grant rights to access, delete, correct, port, and opt out of sale/targeted advertising.

CCPA/CPRA applies to for-profit entities doing business in California meeting one of: >$25M annual gross revenue, buying/selling/sharing PI of 100,000+ consumers or households, or 50%+ revenue from selling/sharing PI.

CCPA thresholds and dollar figures are adjusted for inflation every odd-numbered year by the California Privacy Protection Agency.

Sensitive data categories (e.g., SSN, precise geolocation, health, race/ethnicity, religion, sexual orientation, biometric, genetic) generally require opt-in consent or a right to limit use under state laws.

Universal opt-out mechanisms (e.g., Global Privacy Control) must be honored as valid opt-out of sale/sharing under CPRA and several other state laws.

State laws commonly require data protection assessments before processing that presents heightened risk of harm, such as targeted advertising, sale, or sensitive data processing.

Sectoral state laws include breach notification statutes in all 50 states, biometric privacy laws (e.g., Illinois BIPA), and data disposal laws.

Enforcement is by state attorneys general and, in California, the CPPA; many laws provide cure periods that are narrowing or expiring.

A privacy program is built on the NIST Privacy Framework functions: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P.

Accountability requires named ownership: a DPO or privacy officer, a privacy steering committee, and business-unit privacy champions with defined RACI roles.

Data inventory and records of processing activities (RoPA) are foundational; each record should capture purpose, categories of data and subjects, recipients, retention, and cross-border transfers.

Data classification schemes (public, internal, confidential, restricted) drive handling rules and control selection.

Privacy by design and by default (Cavoukian's principles) require embedding privacy into system design and minimizing collection without user action.

Policies must be operationalized via procedures, standards, and controls, and aligned with frameworks such as NIST Privacy Framework, ISO/IEC 27701, and the AICPA Privacy Management Framework.

Retention schedules should reflect legal, contractual, and operational needs, with documented disposition and legal hold processes.

Program metrics and KPIs (e.g., DSR cycle time, training completion, assessment coverage) demonstrate effectiveness to leadership and regulators.

Core rights across US laws: notice at collection, access/know, deletion, correction, portability, opt out of sale/sharing/targeted advertising, and limit use of sensitive data.

Verification of identity must be proportionate to the sensitivity of the data and request; do not collect more data than necessary to verify.

Response timelines: CCPA generally requires response within 45 days with a possible 45-day extension; other state laws typically require 45 or 60 days.

Authorized agents may submit requests on a consumer's behalf, subject to verification and, in some states, written permission.

Consent must be freely given, specific, informed, and unambiguous where required; opt-in is needed for sensitive data and known minors in many state regimes.

Consent management platforms should record consent state, timestamp, version of the notice, and the mechanism used, supporting audit and withdrawal.

Withdrawal of consent must be as easy as giving it, and opt-out preference signals must be processed automatically where required.

Denials must be justified by a statutory exception and communicated with appeal rights where state law provides them.

A DPIA/PIA identifies and mitigates privacy risks of a processing activity before it launches; triggers include new technology, sensitive data, large-scale monitoring, and profiling.

NIST Privacy Framework and ISO/IEC 29134 provide structured methods for privacy risk assessment and DPIA execution.

Risk is assessed as likelihood and impact to individuals, distinct from organizational/security risk, and should consider context, identifiability, and power imbalance.

A DPIA should document purpose, necessity and proportionality, data flows, risks to individuals, mitigations, residual risk, and sign-off.

High residual risk may require consultation with a supervisory authority or senior leadership approval before proceeding.

Threat modeling (e.g., LINDDUN) supports privacy risk identification: linking, identifying, non-repudiation, detecting, data disclosure, unawareness, non-compliance.

Assessments should be revisited when processing changes, and integrated into procurement and change-management workflows.

Risk treatment options: avoid, mitigate, transfer (contract/insurance), or accept, with documented rationale and owner.

US has no general cross-border transfer restriction, but sectoral rules (e.g., HIPAA, GLBA, export controls) and contractual obligations may apply.

The EU-US Data Privacy Framework (2023) is the current adequacy mechanism for transfers from the EU to certified US organizations; it replaced Privacy Shield, which was invalidated by Schrems II.

Standard Contractual Clauses and Binding Corporate Rules remain alternatives; SCCs require a transfer impact assessment post-Schrems II.

Vendor due diligence should assess security controls, subprocessor use, data location, breach notification commitments, and privacy maturity.

Contracts should include data processing terms, confidentiality, security requirements, audit rights, subprocessor approval, deletion/return, and indemnity.

Maintain a vendor inventory with risk tiering and periodic reassessment based on data sensitivity and criticality.

Subprocessor chains require flow-down obligations and notice/approval rights consistent with the primary contract.

Offboarding must include verified data deletion or return and revocation of access, with evidence retained.

Breach notification laws exist in all 50 states, DC, and territories; definitions of personal information and harm thresholds vary by jurisdiction.

Most state laws require notice without unreasonable delay, often with a 30- or 45-day outer limit, to affected individuals, attorneys general, and sometimes consumer reporting agencies.

HIPAA breach notification requires notice to individuals within 60 days of discovery; breaches affecting 500+ individuals also require HHS and media notice.

GDPR requires notification to the supervisory authority within 72 hours of awareness where feasible, and to individuals without undue delay if high risk.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned (NIST SP 800-61).

Security safeguards should align with NIST CSF or ISO/IEC 27001; reasonable security is a common legal standard enforced by the FTC and state AGs.

A documented incident response plan should define roles, escalation, communication templates, forensic vendor relationships, and legal privilege considerations.

Breach risk assessment should consider data type, volume, encryption status, and likelihood of harm; encryption safe harbors exist in many state laws.

Privacy operations include intake, triage, and tracking of DSRs, incidents, assessments, and vendor reviews with defined SLAs.

Role-based privacy training should be tailored to function (engineering, marketing, HR, sales) and refreshed annually, with completion tracked.

Training content should cover handling rules, incident reporting, DSR escalation, and consequences of non-compliance.

Auditing and monitoring should include periodic control testing, sampling of DSR responses, and review of vendor compliance.

Metrics such as DSR volume and cycle time, incident counts, training completion, and assessment coverage support continuous improvement.

Independent assessments (internal audit, third-party certification like ISO/IEC 27701 or TrustArc) provide assurance to leadership and customers.

Findings should be tracked to remediation with owners, due dates, and verification of closure.

Documentation retention supports defensibility: retain RoPAs, DPIAs, training records, and audit evidence per retention policy.