--- title: "United States — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/controller-processor-duties/ source_html: /jurisdictions/united-states/controller-processor-duties/index.html description: "United States — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 5 claims Amber ▾ # Security, DPIA-equivalent, and breach-notification duties exist but are fragmented by sector an" generated_at: 2026-10-25T04:46:50Z content_sha256: 43bd204e734158bc70c0d85ae28bf68bb10135b952f79308ce433f776e6bde17 generator: "fe-fleet/md-twin@1.0" --- # United States — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules5 claimsAmber▾# Security, DPIA-equivalent, and breach-notification duties exist but are fragmented by sector and state rather than unified; DPO and ROPA obligations are largely absent federally. Primary framework CCPA regulations (Cal. Code Regs. tit. 11); COPPA Rule (as amended 2025); GLBA Safeguards Rule; FTC Health Breach Notification Rule Supervisory authority [Federal Trade Commission (FTC)](https://www.ftc.gov) Traffic-light rationale — Amber Security, DPIA-equivalent, and breach-notification duties exist but are fragmented by sector and state rather than unified; DPO and ROPA obligations are largely absent federally. #### Sub-modules (7) #### Accountability And DpiaAmber California's CCPA regulations for automated-decision-making technology, risk assessments, and cybersecurity audits became applicable 1 January 2026, functioning as a DPIA-equivalent at state level. Claims (1): - California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026. #### Dpo RequirementsRed No general federal or California statutory requirement to appoint a Data Protection Officer was identified. Absence provenance: unavailable . Searched: California CCPA DPO requirement 2026, US federal data protection officer mandate. #### Ropa RequirementsRed No general federal records-of-processing-activity requirement was identified; some state risk-assessment regimes function as partial analogues. Absence provenance: unavailable . Searched: CCPA records of processing requirement, US federal ROPA equivalent. #### Joint Controller ArrangementsAmber CCPA imposes contractual flow-down obligations on businesses regarding service providers/third parties (vendor contract terms restricting secondary use), enforced through recent CalPrivacy actions. Claims (1): - CalPrivacy enforcement actions (e.g., Tractor Supply) have found violations for using weak vendor agreements lacking restrictive data-use clauses, establishing de facto vendor-contract expectations under CCPA. #### Security MeasuresAmber GLBA's Safeguards Rule imposes data-security-program obligations on financial institutions (including auto dealers extending credit), enforced by the FTC. Claims (1): - The FTC enforces the GLBA Safeguards Rule against financial institutions, including automobile dealers extending credit, requiring implementation of data-security programs. #### Breach NotificationAmber The FTC's Health Breach Notification Rule requires notice of breaches of personal health records by non-HIPAA-covered entities; GLBA and state laws impose parallel breach-notice duties in their respective sectors. Claims (1): - The FTC's Health Breach Notification Rule requires entities not covered by HIPAA to notify consumers and the FTC of breaches of personal health record data. #### Retention And DisposalAmber The 2025 COPPA amendments create retention-limitation duties, preventing indefinite retention of children's personal data beyond the specific documented purpose. Claims (1): - The 2025 COPPA Rule amendments require covered operators to retain children's personal information only as long as reasonably necessary to fulfill the specific documented purpose for which it was collected. Category narrative 63 words Accountability obligations are sector- and state-specific. California's 2026 CCPA regulations introduce risk assessments, automated-decision-making-technology (ADMT) rules, and cybersecurity audit requirements. COPPA's 2025 amendments impose data-minimization and retention-limitation duties for children's data. GLBA's Safeguards Rule imposes security-program duties on financial institutions, and the FTC Health Breach Notification Rule imposes breach-notice duties on non-HIPAA-covered health apps. No general federal DPO-appointment mandate or ROPA requirement exists. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins) — California CCPA regulations for automated decision-making technology, risk assessments, and cybersecurity audits became applicable on 1 January 2026.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/retail-under-review-californias-new-era-of-privacy-enforcement) — CalPrivacy enforcement actions (e.g., Tractor Supply) have found violations for using weak vendor agreements lacking restrictive data-use clauses, establishing de facto vendor-contract expectations under CCPA.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement) — The FTC enforces the GLBA Safeguards Rule against financial institutions, including automobile dealers extending credit, requiring implementation of data-security programs.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/business-guidance/privacy-security/consumer-privacy) — The FTC's Health Breach Notification Rule requires entities not covered by HIPAA to notify consumers and the FTC of breaches of personal health record data.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/ftc-finalizes-coppa-rule-amendments) — The 2025 COPPA Rule amendments require covered operators to retain children's personal information only as long as reasonably necessary to fulfill the specific documented purpose for which it was collected.observed 2026-07-29