CevroUnited States and Guam: US privacy and security laws and what it requires
Sectoral + state laws (no comprehensive federal law): a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Federal Trade Commission (FTC) + state regulators.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Not required |
| Data localization | Not required |
Penalties and enforcement
Varies by statute and state — from FTC enforcement actions to state-specific fines (e.g. under CCPA/CPRA).
What to know in practice
A patchwork: HIPAA, COPPA, and GLBA at the federal sectoral level, plus state laws (California's CCPA/CPRA, Virginia, Colorado, and others). Multi-state reach means multi-regime compliance.
How Cevro helps
- Maps US privacy and security laws to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in United States and Guam?
Federal Trade Commission (FTC) + state regulators oversees Sectoral + state laws (no comprehensive federal law).
Is breach notification mandatory under US privacy and security laws?
Our reference does not record a fixed hourly deadline for US privacy and security laws. Check the statute and Federal Trade Commission (FTC) + state regulators guidance for the notification timing that applies to you.
Does United States and Guam restrict cross-border data transfers?
Our reference records no general restriction on cross-border transfers, although sector rules and contracts can still apply.
Do you need a data protection officer under US privacy and security laws?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in United States and Guam?
Varies by statute and state — from FTC enforcement actions to state-specific fines (e.g. under CCPA/CPRA).