#
Security, DPIA-equivalent, and breach-notification duties exist but are fragmented by sector and state rather than unified; DPO and ROPA obligations are largely absent federally.
Sub-modules (7)
Accountability And DpiaAmber
California's CCPA regulations for automated-decision-making technology, risk assessments, and cybersecurity audits became applicable 1 January 2026, functioning as a DPIA-equivalent at state level.
Claims (1):
- California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026.
Dpo RequirementsRed
No general federal or California statutory requirement to appoint a Data Protection Officer was identified.
Absence provenance: unavailable. Searched: California CCPA DPO requirement 2026, US federal data protection officer mandate.
Ropa RequirementsRed
No general federal records-of-processing-activity requirement was identified; some state risk-assessment regimes function as partial analogues.
Absence provenance: unavailable. Searched: CCPA records of processing requirement, US federal ROPA equivalent.
Joint Controller ArrangementsAmber
CCPA imposes contractual flow-down obligations on businesses regarding service providers/third parties (vendor contract terms restricting secondary use), enforced through recent CalPrivacy actions.
Claims (1):
- CalPrivacy enforcement actions (e.g., Tractor Supply) have found violations for using weak vendor agreements lacking restrictive data-use clauses, establishing de facto vendor-contract expectations under CCPA.
Security MeasuresAmber
GLBA's Safeguards Rule imposes data-security-program obligations on financial institutions (including auto dealers extending credit), enforced by the FTC.
Claims (1):
- The FTC enforces the GLBA Safeguards Rule against financial institutions, including automobile dealers extending credit, requiring implementation of data-security programs.
Breach NotificationAmber
The FTC's Health Breach Notification Rule requires notice of breaches of personal health records by non-HIPAA-covered entities; GLBA and state laws impose parallel breach-notice duties in their respective sectors.
Claims (1):
- The FTC's Health Breach Notification Rule requires entities not covered by HIPAA to notify consumers and the FTC of breaches of personal health record data.
Retention And DisposalAmber
The 2025 COPPA amendments create retention-limitation duties, preventing indefinite retention of children's personal data beyond the specific documented purpose.
Claims (1):
- The 2025 COPPA Rule amendments require covered operators to retain children's personal information only as long as reasonably necessary to fulfill the specific documented purpose for which it was collected.
no periodic updates on record for this sub-brief
Sources and claims (5)
- ProbableIAPP — California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026.observed
- ProbableIAPP — CalPrivacy enforcement actions (e.g., Tractor Supply) have found violations for using weak vendor agreements lacking restrictive data-use clauses, establishing de facto vendor-contract expectations under CCPA.observed
- ProbableFTC — The FTC enforces the GLBA Safeguards Rule against financial institutions, including automobile dealers extending credit, requiring implementation of data-security programs.observed
- ProbableFTC — The FTC's Health Breach Notification Rule requires entities not covered by HIPAA to notify consumers and the FTC of breaches of personal health record data.observed
- ProbableIAPP — The 2025 COPPA Rule amendments require covered operators to retain children's personal information only as long as reasonably necessary to fulfill the specific documented purpose for which it was collected.observed