With the ever-evolving data privacy landscape and a growing number of state and international privacy laws, it can be very cumbersome to identify which of these apply to your organization and furthermore how your organization must comply. Dependent on your organization’s business model, industry and many other factors, you will likely need to comply with at least one and potentially more of the data privacy regulations listed below, which is not an exhaustive list. We have helped organizations across industries, both domestically and globally, to both prepare for and achieve compliance with these data privacy regulations:
The GDPR is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018 to protect and empower all EU citizens with respect to data privacy, reshaping the way organizations across the globe approach data privacy. The GDPR can levy harsh fines against those who violate its privacy and security standards, with penalties equivalent to the greater of €20m or 4% of total revenue.
In November 2020, over 9.3 million Californians voted to approve the CPRA of 2020 with the passage of Proposition 24. The CPRA is the strongest consumer privacy law ever enacted in the United States and achieves broad general parity with the most comprehensive laws in other jurisdictions including the GDPR.
CPRA builds on existing California law passed in 2018 (the California Consumer Privacy Act (CCPA)) and applies to personal information collected after January 1, 2022 which will be enforced January 1, 2023. CPRA builds upon CCPA, in a number of ways:
The CCPA gives consumers more control over the personal information that businesses collect about them. This law secures new privacy rights for California consumers, including
HIPAA was developed to protect the privacy and security of certain health information. To fulfill this requirement, the U.S. Department of Health & Human Services (HHS) published the HIPAA Privacy and Security Rules. The Privacy Rule establishes national standards for the protection of certain health information.
The Security Rule establishes a national set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalized the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals “electronically protected health information” (e-PHI).
The Privacy Rule is to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. Given that the health care marketplace is diverse, the Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity’s particular size, organizational structure, and risks to consumers’ e-PHI. Within HHS, the Office for Civil Rights (OCR) has responsibility for enforcing the Privacy and Security Rules with voluntary compliance activities and civil money penalties.
The GLBA is a Federal law, known as the Financial Modernization Act of 1999, which applies to financial institutions, including higher-education institutions. The intent of GLBA is to protect the security, confidentiality and integrity of customer information, where customer information is any record containing non-public personal information…about a customer of a financial institution, whether in paper, electronic, or other forms that are handled or maintained by or on behalf of the institution.
Business Process and Data Flow
A critical component to understanding how an organization’s data (oftentimes consumer data) travels throughout its lifecycle is to develop business processes and data flow diagrams. Learn More
Data Privacy Control Assessment
Regardless of whether your data privacy program was recently established or tenured, it’s important to assess its ongoing effectiveness in today’s ever-evolving technological world. Learn More
Data Protection Impact AssessmentÂ
A Data Protection Impact Assessment (DPIA) is a process to help identify and minimize data protection risks to an organization. Learn More
NIST Privacy Framework Compliance
The NIST Privacy Framework is intended to be leveraged as a foundation to help organizations identify and manage privacy risk to build innovative products and services while protecting individuals’ privacy. Learn More
Privacy by Design
Our approach to Privacy by Design ensures that privacy and security controls are aligned with an organization’s tolerance for risk, its compliance with regulations, and its commitment to building a sustainable privacy-minded culture.  Learn More
At Schneider Downs, our IT Risk Advisory Practice has a team of professionals who specialize in data privacy. Our team not only understands the evolving data privacy regulations but also the technologies that allow for opportunities to enable controls in the effort of reducing and protecting the data footprint and ongoing risks of non-compliance.
Learn more about Schneider Downs Data Privacy Services or contact us for more information.
Receive all the latest insights and industry tips.
Schneider Downs is a Top 60 independent Certified Public Accounting (CPA) firm providing accounting, tax, audit and business advisory services to public and private companies, not-for-profit organizations and global companies. We also offer Internal Audit; Technology Consulting; Software Solutions; Personal Financial Services; Retirement Plan Solutions and Corporate Finance Services. Schneider Downs is the 13th largest accounting firm in the Mid-Atlantic region and serves individuals and companies in Pennsylvania (PA), Ohio (OH), West Virginia (WV), New York (NY), Maryland (MD), and additional states in the United States with offices in Pittsburgh, PA, Columbus, OH, and McLean, VA.
© 2024 Schneider Downs & Co., Inc. Maryland license number 35239.
Every moment counts. For urgent requests, contact the Schneider Downs digital forensics and incident response team at 1-800-993-8937. For all other requests, please complete the form below.
