Supported Control Frameworks

Australian Privacy Principles (APP)

To provide a basis for handling personal data, facilitates the free flow of information outside of Australia, and ensures that individuals’ privacy rights are respected and enforced.

Australian Government agencies and organizations with an annual turnover of more than $3 million and some other organizations.

N/A

Yes

California Consumer Privacy Act (CCPA as amended) (2025)

To protects natural persons or consumers and obliges businesses to undertake certain requirements with regard to the processing of personal information.

For-profit businesses that do business in California and meet any of the following:

• Have a gross annual revenue of over $25 million;

• Buy, sell, or share the personal information of 100,000 or more California residents or households; or

• Derive 50% or more of their annual revenue from selling California residents’ personal information.

Yes, annually

Cybersecurity audits by a qualified independent professional must be completed and certifications sent to CPPA. The audit requirement applies only to businesses that meet specific thresholds. The first audit deadlines are staggered based on business size (annual gross revenue). For more information, CPPA Regulations.

Yes

Center for Internet Security (CIS) Controls v8.1

CIS is a prioritized set of safeguards used to mitigate the most prevalent cyber-attacks against systems and networks.

Any organization.

N/A

No

China Personal Information Protection Law (PIPL)

To protects individuals’ personal information rights by regulating entities that process personal information within China or conduct certain cross-border processing activities and establishes clear requirements for lawful processing, transparency, security, and accountability, without revenue or data-volume thresholds.

Any organization or individual that processes personal information within China, as well as certain processing activities conducted outside China that involve providing products or services to individuals in China or analyzing their behavior.

N/A

Yes

Criminal Justice Information Services (CJIS) Security Policy v5.9.5

To provide appropriate controls to protect the full lifecycle of Criminal Justice Information (CJI), whether at rest or in transit. The CJIS Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI.

Contractors, private entities, noncriminal justice agency representatives, or members of a criminal justice entity—with access to, or who operate in support of, criminal justice services and information.

Yes, every 3 years by the FBI CJIS Division

No

Colorado AI Act

To establish governance, transparency, risk management, and consumer protection requirements for developers and deployers of high-risk AI systems used in consequential decisions.

Organizations doing business in Colorado that develop or deploy high-risk AI systems.

N/A

No

Colorado Privacy Act (CPA)

To provide guidelines for businesses to provide consumers with clear privacy notices and conduct data protection assessments for personal data processing of high risk. It also grants consumers a number of rights with respect to their personal information.

Controllers that conduct business in Colorado and meet any of the following criteria:

• Controls or processes the personal data of 100,000 or more consumers during a calendar year; or

• Derives revenue or receives discounts on the price of goods or services from the sale of personal data and process; or

• Controls the personal data of 25,000 or more consumers

N/A

Yes

Connecticut Data Privacy Act (CTDPA)

To provide guidelines for businesses to provide consumers with clear privacy notices and conduct data protection assessments for personal data processing of high risk. It also grants consumers a number of rights with respect to their personal information.

Entities who conduct business in Connecticut or who produce products or services targeted to Connecticut residents and that, during the prior calendar year:

• Controlled or processed the personal data of at least 35,000 consumers;

• Control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or

• offer consumers' personal data for sale in trade or commerce

N/A

Yes

CyberSecure Canada

CyberSecure Canada is a framework designed for Small and Medium Enterprises (SMEs) seeking CyberSecure Canada certification, which is set by the Standards Council of Canada (SCC). Certification is achieved by implementing the baseline cyber security controls for small and medium organizations, also called Security Control Areas.

Small and medium-sized organizations.

Voluntary Certification

No

Cybersecurity Maturity Model Certification (CMMC) v2

To enhance the cybersecurity posture of the Defense Industrial Base (DIB). It is designed to enforce protection of sensitive unclassified information that the department shares with its contractors and subcontractors.

Anyone in the defense contract supply chain. These include contractors who engage directly with the Department of Defense and subcontractors contracting with primes to fulfill and/or execute those contracts.

Yes, every 3 years

No

Databricks AI Governance and Security

To establish a comprehensive set of governance and security controls to help organizations manage AI risks, protect AI assets, and ensure responsible, secure, and compliant use of AI systems on the Databricks platform.

Organizations building, deploying, or operating AI systems that need to demonstrate strong AI governance, security, and risk management practices.

N/A

No

Delaware Personal Data Privacy Act (DPDPA)

To target organizations based on the volume of data they process and the revenue generated from selling personal data, specifically protecting the rights of consumers in personal and/or household contexts.

The DPDPA applies to any person who conducts business in Delaware, or who provide products or services to residents of Delaware, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 35,000 consumers (excluding payment transactions); or

• Control or process the personal data of at least 10,000 consumers and derive more than 20% of gross revenue from the sale of personal data.

N/A

Yes

Diversity, Equity, & Inclusion

To implement best practices that capture the uniqueness of individuals, address systemic inequities, and create a culture that values respect, acceptance, and equal access to all opportunities.

Organizations across various industries that want to build stronger relationships with employees, customers, and the community while driving positive social impact and business outcomes.

N/A

No

Digital Operational Resilience Act (DORA)

To improve the resilience of financial services by ensuring digital systems are able to withstand cyber threats and other operational disruptions. DORA is a major piece of European Union (EU) legislation on cybersecurity for financial entities.

In Jan 2024, the European Supervisory Authorities (ESA) released the first batch of Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) under the Digital Operational Resilience Act (DORA). The first batch covered ICT risk management, criteria for classifying ICT-related incidents, policies for managing critical ICT services by third-party providers, and templates for maintaining Register of Information (ROI). The second batch, released in July 2024, focused on content, templates, and timelines for reporting major ICT-related incidents and cyber threats, harmonizing oversight activities, and requirements for threat-led penetration testing (TLPT).

Financial Entities as listed under Article 2 of Regulation (EU) 2022/2554 of the European Parliament.

Yes, guidance due in July 2025

No

Essentials

To provide foundational policies and controls for businesses to begin their compliance journey.

Any organization.

N/A

No

EU AI Act

To establish a harmonized framework for the development, placement, and use of Artificial Intelligence (AI) systems within the European Union. Its goal is to ensure that AI systems used in the EU respect fundamental rights, ensure transparency, safety, and human oversight, and prevent harm to individuals and society.

Providers, deployers, importers, distributors, and authorized representatives are subject to the EU AI Act if they meet any of the following criteria:

• Intend to place AI systems on the market or put them into service within the EU.

• Have AI systems whose outputs are used within the EU, regardless of where the AI system itself is developed or hosted.

• Operate AI systems that are located in a non-EU country but are still subject to EU Member State laws under public international law.

N/A

No

EU Cyber Resilience Act Framework

To establish cybersecurity requirements for products with digital elements to ensure a high level of security throughout their lifecycle and improve the overall resilience of the EU digital market.

Manufacturers, importers, and distributors placing connected hardware or software products on the EU market. This includes organizations developing, selling, or integrating products with digital elements, particularly those classified as important or critical under Annex III of the Regulation.

Important and critical products with digital elements must undergo a conformity assessment procedure, which may involve a Notified Body depending on product classification.

Audit Method

Conducted internally or by a Notified Body, depending on risk level.

Timing

Required before market entry and after major updates affecting cybersecurity.

Ongoing Obligations

Continuous compliance, vulnerability management, and incident reporting are mandatory.

No

EU General Data Protection Regulation (GDPR) v2

To protect individuals' fundamental rights and freedoms, particularly their right to protection of their personal data.

All businesses that collect the data of EU citizens.

N/A

Yes

Europrivacy

To certify compliance of data processing activities under article 42 GDPR. Europrivacy has been approved by the EU (EDPB) as official European Data Protection Seal.

Any company trying to certify and value their compliance with the GDPR.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

Yes

Federal Financial Institutions Examination Council (FFIEC)

To prescribe uniform principles, standards, and report forms to promote uniformity in the supervision of financial institutions.

Banks, credit unions, and mortgage lenders. And all Federally supervised financial institutions.

Yes, annually

No

Florida Digital Bill of Rights (FDBR)

To ensure that personal data of Florida residents is managed with care and transparency.

The Digital Bill of Rights applies to a person who:

• conducts business in this state or produces a product or service used by residents of this state; and

• processes or engages in the sale of personal data.

It applies only to controllers that generate more than $1 billion in global gross annual revenue and that:

• Derive at least 50% of global gross annual revenues from the sale of advertisements online;

• Operate an app store or digital distribution platform that offers at least 250,000 different software applications for consumers to download and install; or

• Operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud-computing service that uses hands-free verbal activation (but not including in-car smart speaker and voice command component services operated by vehicle manufacturers).

N/A

Yes

Health Insurance Portability and Accountability Act (HIPAA)

To protect patients' health information (PHI).

Healthcare providers - it applies to health plans, healthcare clearinghouses, and any healthcare provider who transmits health information in electronic form.

N/A

Yes

India Digital Personal Data Protection Act (2023)

To regulate the processing of digital personal data, i.e., personal data collected in digital form or collected in non-digital form and subsequently digitized. As an umbrella legislation, the DPDPA establishes a high-level framework for data protection in India, with detailed rules to follow.

The DPDPA applies to the processing of personal data in a digital form, or in a non-digital form and subsequently digitized, within India as well as outside India in connection with offering goods or services to individuals within the territory of India.

It applies to data fiduciaries, that is, entities that determine the means and purpose of processing personal data either alone or jointly with others.

Annual for Significant Data Fiduciaries (as required under Rule 13 of the DPDP Rules)". For more information, see DPDP Rules.

Yes

Indiana Digital Personal Data Protection Act (ICDPA) 2025

To protect consumers' rights in personal and household contexts by targeting businesses that process or sell personal data.

The ICDPA applies to any person who conducts business in Indiana, or who provide products or services to residents of Indiana, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 100,000 unique Indiana consumers; or

• Derive over 50% of gross revenue from the sale of personal data and process the personal data of at least 25,000 consumers.

N/A

Yes

Iowa Consumer Data Protection Act (ICDPA)

To target organizations based on the volume of data they process and the revenue generated from selling personal data, specifically protecting the rights of consumers in personal and/or household contexts.

The ICDPA applies to any person who conducts business in Iowa, or who provide products or services to residents of Iowa, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 100,000 Iowa residents; or

• Control or process the personal data of at least 25,000 Iowa residents and derive over 50% of their gross revenue from the sale of personal data.

N/A

Yes

ISO 27001:2013

Available with License

To build and maintain an information security management system (ISMS).

Any company handling sensitive data.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

No

ISO 27001:2022

Available with License

To build and maintain an information security management system (ISMS). Organizations must integrate climate change considerations into their ISMS where applicable.

Any company handling sensitive data.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

No

ISO 27017:2015

Available with License

To provide a set of guidelines for safeguarding cloud-based environments and minimizing the potential risk of security incidents.

Cloud service providers and cloud service customers.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

No

ISO 27018:2019

Available with License

To address the requirements of data protection law focusing on the processing of personal data within the cloud.

Cloud service providers who process personally identifiable information (PII) for their customers.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

No

ISO 27701:2019

Available with License

To allow an organization to demonstrate effective privacy data management. ISO 27701:2019 is the standard for data privacy controls.

Any company handling personally identifiable information (PII).

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

Yes

ISO 42001:2023

Available with License

To build and maintain an Artificial Intelligence Management System (AIMS).

Any company that is developing, deploying, or using AI systems.

Yes, certification renewal audit is every 3 years; surveillance audit is done annually

No

ISO/IEC 27701:2025

Available with License

To establish a structured, requirements-based approach to building and operating a Privacy Information Management System (PIMS) that supports consistent privacy governance, accountability, and continual improvement for organizations processing PII as controllers and/or processors.

Any organization (regardless of size or sector) that processes PII and wants a globally recognized, management-system-based approach to privacy that can support due diligence, customer assurance, and alignment to multiple privacy obligations.

Yes; certification renewal audit is every 3 years; organizations typically perform internal audits to maintain the PMS and demonstrate ongoing improvement.

Yes

IT General Controls (ICFR, SOX, SOC1)

To provide general Information Technology (IT) controls for the organization's financial reporting systems. The organization can utilize these IT controls as part of their Internal Controls over Financial Reporting (ICFR), SOX 1, and the SOC1 certification process.

Any organization.

Yes, annually

No

Kentucky Consumer Data Protection Act (KYCDPA)

To protects consumers' rights in personal and household contexts by targeting businesses that process or sell personal data, regardless of revenue or data volume thresholds.

The KYCDPA applies to any person who conducts business in Kentucky, or who provide products or services to residents of Kentucky, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 100,000 unique Kentucky consumers; or

• Derive over 50% of gross revenue from the sale of personal data and process the personal data of at least 25,000 consumers.

N/A

Yes

Maryland Online Data Privacy Act (MODPA)

To afford protection to consumers who are residents of Maryland by granting them rights over their personal data. MODPA applies to businesses operating within Maryland that meet the required thresholds, as well as businesses outside the state that target Maryland residents, ensuring that consumer privacy is safeguarded for all Maryland residents.

MODPA applies to a person that conducts business in Maryland or provides products or services that are targeted to Maryland residents, and that during the preceding calendar year did any of the following:

• controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

• controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.

N/A

Yes

Minnesota Consumer Data Privacy Act (MNCDPA)

To protects consumers' rights in personal and household contexts by targeting businesses that process or sell personal data, regardless of revenue or data volume thresholds.

Any person who conducts business in Minnesota, or who provide products or services to residents of Iowa, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 100,000 unique Minnesota consumers; or

• Derive over 25% of gross revenue from the sale of personal data and process the personal data of at least 25,000 consumers.

N/A

Yes

Montana Consumer Data Privacy Act (MTCDPA)

To target organizations based on the volume of data they process and the revenue generated from selling personal data.

Businesses operating in Montana or businesses thatproduce products or services that are targeted to Montana residents and that:

• Control or process personal data of at least 50,000, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

• Control or process the personal data of at least 25,000 consumers and derive more than 25% of gross revenues from the sale of personal data.

N/A

Yes

NAIC Model Bulletin: Use of AI by Insurers

To define guidelines for the responsible, ethical, and transparent development, acquisition and use of AI in insurance by ensuring AI systems are fair, secure, accountable, and do not result in unfair discrimination. It emphasizes strong governance, data protection, and consumer rights throughout the AI system lifecycle.

The framework is intended to be voluntary, therefore any insurance organization can benefit from implementing the NAIC model bulletin on the use of AI by insurers.

N/A

No

Nebraska Data Privacy Act (NEDPA)

To protect consumers' rights in personal and household contexts by targeting businesses that process or sell personal data, regardless of revenue or data volume thresholds.

The NEDPA applies to any person who conducts business in Nebraska, or who provide products or services to residents of Nebraska, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 35,000 unique Nebraska consumers; or

• Control or process the personal data of at least 10,000 unique Nebraska consumers and derive over 20% of their gross revenue from the sale of personal data.

N/A

Yes

Network and Information Security Directive (NIS2)

Available with License

To achieve a high common level of cybersecurity across the member state. NIS2 is an EU-wide legislation on cybersecurity.

Organizations with more than 50 employees whose annual turnover exceeds €10 million.

Organizations from the following industries also need to be NIS2 compliant:

• Electronic Communication

• Digital Services

• Waste Management

• Food

• Space

• Critical Product Manufacturing

• Postal Services

• Public Administration

N/A

No

New Hampshire Privacy Act (NHPA)

To target organizations based on the volume of data they process and the revenue generated from selling personal data, specifically protecting the rights of consumers in personal and/or household contexts.

Any person who conducts business in New Hampshire, or who provide products or services to residents of New Hampshire, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 35,000 unique New Hampshire consumers; or

• Control or process the personal data of at least 10,000 unique New Hampshire consumers and derive over 25% of their gross revenue from the sale of personal data.

N/A

Yes

New Jersey Data Privacy Law (NJDPL)

To grant New Jersey residents control over their personal data, allowing them to access, correct, delete, and transfer their information.

Any person who conducts business in New Jersey, or who provides products or services to residents of New Jersey, and that during a calendar year, controls or processes:

• Control or process the personal data of at least 100,000 unique New Jersey consumers; or

• Control or process the personal data of at least 10,000 unique New Jersey consumers and derives revenue from the sale of personal data.

N/A

Yes

NIS 2 (Belgium)

To enforce Belgium’s implementation of the EU NIS2 Directive, requiring important and essential entities to adopt comprehensive cybersecurity and incident reporting measures.

Organizations operating in Belgium that provide important or essential services and meet the size criteria defined under the NIS2 legislation.

Yes, every 3 years for essential entities by Conformity Assessment Bodies (CAB)

No

NIS 2 (Germany)

To strengthen cybersecurity resilience across critical and important sectors in Germany by requiring regulated entities to implement risk management measures, maintain governance oversight, register with the BSI, manage ICT and supply chain risks, and report significant security incidents within required timelines.

The NIS2 Germany Framework is best used by organizations operating in Germany that may qualify as essential, important, or critical entities under the German NIS2 implementation regime. This includes organizations in sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research.

N/A

No

NIS 2 (Italy)

To enforce Italy’s implementation of the EU NIS2 Directive, requiring important and essential entities to adopt comprehensive cybersecurity and incident reporting measures.

Organizations operating in Italy that provide critical or important services (listed in Annexes I–IV of the NIS 2 Decree) and meet the size criteria defined under the NIS2 legislation. Organizations that do not meet the size criteria may still fall under NIS 2 if they are deemed vital to the security or continuity of a larger supply chain.

Entities should review the official guidance from the National Cybersecurity Agency (ACN) to determine applicability.

N/A

No

NIST AI Risk Management Framework (AI RMF)

To equip organizations with practices that increase the trustworthiness of AI systems, and to help foster the responsible design, development, deployment, and use of AI.

Any organization.

N/A

No

NIST Cybersecurity Framework (CSF) v1.1

To provide comprehensive and personalized security weakness identification.

Any organization.

N/A

No

NIST Cybersecurity Framework (CSF) v2.0

To help businesses and organizations manage their cybersecurity risk.

The NIST Cyber Security Framework (CSF) is a set of cybersecurity guidelines and best practices developed by the National Institute of Standards and Technology (NIST) part of the United States Department of Commerce

Any organization that wants to manage and reduce their cybersecurity risks.

N/A

No

NIST Privacy

To help organizations identify and manage privacy risk to build innovative products and services while protecting individuals’ privacy. NIST Privacy is a voluntary tool.

Organizations that process personal information.

N/A

Yes

NIST 800-171

To provide standards for safeguarding sensitive information on federal contractor’s IT systems and network.

Federal contractors that handle, process, or store Controlled Unclassified Information (CUI) on their networks.

N/A

No

NIST 800-171 Rev 3

To provide standards for safeguarding sensitive information on federal contractor’s IT systems and network.

Federal contractors that handle, process, or store Controlled Unclassified Information (CUI) on their networks.

N/A

No

NIST 800-172

To supplement NIST SP 800-171 by providing enhanced security requirements for protecting Controlled Unclassified Information (CUI).

Federal contractors that handle, process, or store Controlled Unclassified Information (CUI) on their networks.

N/A

No

NIST 800-53

To provide a catalog of security and privacy controls for information systems and organizations, updated in Release 5.2 to strengthen software update, patching, resiliency, and software integrity practices.

Any organizations using NIST SP 800-53 as a baseline for security and privacy control design, implementation, and assessment.

N/A

No

North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP)

To keep North America's bulk electric systems operational.

Entities that own or manage facilities that are part of the U.S. and Canadian electric power grid.

Yes, every 5 years

No

Oklahoma Consumer Data Privacy Act (OKCDPA)

To protect Oklahoma consumers by granting rights over their personal data and ensuring organizations provide transparency, minimize collection and use, safeguard personal data, and honor consumer rights such as access, deletion, and opt‑out.

The OKCDPA applies to controllers and processors that conduct business in Oklahoma or target Oklahoma residents, and during the preceding calendar year either:

• Controlled or processed ≥ 100,000 consumers’ personal data; or

• Controlled or processed ≥ 25,000 consumers’ personal data and derived > 50% of gross revenue from the sale of personal data.

N/A

Yes

Oregon Consumer Privacy Act (OCPA)

To target organizations based on the volume of data they process and the revenue generated from selling personal data, specifically protecting the rights of consumers in personal and/or household contexts.

The OCPA applies to any person who conducts business in Oregon, or who provide products or services to residents of Oregon, and that during a calendar year, controls or processes:

• The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or

• The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person’s annual gross revenue from selling personal data.

N/A

Yes

Payment Card Industry Data Security Standard (PCI DSS) v4.0.1

To protect cardholder data and sensitive authentication data wherever it is processed, stored, or transmitted.

All business that store, process, or transmit payment cardholder.

Yes, annually

No

Quebec Private Sector Act (as amended by Law 25)

To modernizes Québec’s Act respecting the protection of personal information in the private sector (the “Private Sector Act”). It introduces GDPR‑style obligations aimed at ensuring that any organization that collects, uses, communicates or stores personal information in Québec does so in a fair, transparent and accountable manner.

Any private‑sector entity that does business in Québec or handles information about Québec residents. Law 25 applies extra‑territorially, so organizations located outside Québec but offering goods or services inside the province also fall in scope.

N/A

Yes

Rhode Island Data Transparency and Privacy Protection Act Framework (RI-DTPPA)

To protect Rhode Island consumers by granting rights over their personal data and ensuring organizations provide transparency, minimize collection and use, safeguard sensitive data, and honor consent and opt‑out choices.

For‑profit entities that conduct business in Rhode Island or target Rhode Island residents, and during the preceding calendar year either:

• Controlled or processed ≥ 35,000 customers’ personal data, excluding data processed solely to complete a payment transaction; or

• Controlled or processed ≥ 10,000 customers’ personal data and derived > 20% of gross revenue from the sale of personal data.

N/A

Yes

Saudi Arabia Personal Data Protection Law (PDPL)

To establish a legal framework for the collection, processing, storage, and transfer of personal data to ensure the protection of individual privacy and regulate organizational accountability in handling personal data.

Applies to organizations that process personal data of individuals in Saudi Arabia and need to comply with national data protection requirements, particularly those operating within or targeting the Saudi market.

N/A

Regulatory oversight by the competent authority (SDAIA), with potential audits, investigations, or requests for evidence of compliance; organizations may also conduct internal audits to support ongoing compliance.

Yes

Service Organization Control Type 2 (SOC 2)

To ensure third-party service providers store and process client data in a secure manner.

Third-party service providers and their partners.

Yes, dependent on the observation period picked by the customer (if six months, then an audit is every six months – else annual)

No

South Korea AI Basic Act

To establish governance, transparency, safety, and accountability requirements for AI business operators, including additional obligations for high-impact AI and certain advanced AI systems.

Organizations whose AI products or services affect users in Korea or the Korean market, including those providing high-impact AI, generative AI, or advanced AI systems subject to the Act’s additional safety requirements.

N/A

Compliance is supported through documentation, impact assessment, safety measures, and the possibility of regulatory investigation and corrective orders.

No

Tennessee Information Protection Act (TIPA)

To establish requirements for businesses to provide consumers with clear and accessible privacy notices. It also grants Tennessee residents several rights over their personal information, including access, correction, deletion, data portability, and the ability to opt out of certain types of data processing.

Any controller or processor that conducts business in Tennessee or offers products or services targeted to Tennessee residents and:

• Has annual revenue exceeding $25,000,000; and

• Controls or processes personal information of at least 25,000 consumers and derives more than 50% of gross revenue from the sale of personal information; or

• Controls or processes personal information of at least 175,000 consumers during a calendar year.

N/A

Yes

Texas Data Privacy and Security Act (TDPSA)

To target organizations conducting business in Texas or offering products or services to Texans, that process or sell personal data, and are not classified as a "small business" by the SBA (United States Small Business Administration) - with no specific thresholds based on annual revenue or volume of personal data processed.

TDPSA applies to entities that meet the following criteria:

• Conduct business in Texas or generate products or services “consumed” by Texas residents;

• Process or engage in the sale of personal data; and

• Does not identify as a small business as defined by the U.S. Small Business Administration (SBA), which varies by industry “usually stated in number of employees or average annual receipts,”

N/A

Yes

Trusted Information Security Assessment Exchange (TISAX) v6.0.1

To ensure information security in the automotive industry.

Entities that want to do business with major German automotive players.

Yes, every 3 years

No

UK Cyber Essentials v3.2

To help organizations protect themselves from common online threats. Cyber Essentials is a UK government-backed, industry-supported scheme.

Any organization.

Yes, annually

No

US State Privacy Legislation Framework

A combination of US State Privacy Laws [California (CCPA and CPRA), Virginia (VCDPA), Colorado (CPA), Utah (UCPA) and Connecticut (CTDPA)] that provide consumers more control over their personal information by granting them certain rights and define requirements/obligations for organizations doing business in these states to be more transparent about their privacy practices.

Applies to organizations doing business in multiple states and looking to demonstrate compliance with each state-specific law more easily. The state-specific scope requirements are as follows:

CCPA/CPRA: For-profit businesses that do business in California and meet any of the following criteria:

• Has a gross annual revenue of over $25 million;

• Buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices; or

• Derives 50% or more of their annual revenue from selling California residents’ personal information.

CPA: Controllers that conduct business in Colorado and meet any of the following criteria:

• Controls or processes the personal data of 100,000 or more consumers during a calendar year; or

• Derives revenue or receives a discount on the price of goods or services from the sale of personal data and process or control the personal data of 25,000 or more consumers.

CTDPA: Entities who conduct business in Connecticut or who produce products or services targeted to Connecticut residents and that, during the prior calendar year:

• Controlled or processed the personal data of at least 35,000 consumers;

• Control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or

• Offer consumers' personal data for sale in trade or commerce

VCDPA: Entities that conduct business in Virginia or produce products or services that are targeted to residents of Virginia and that, during a calendar year, control or process personal data of:

• At least 100,000 consumers; or

• At least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

UCPA: Any controller or processor who conducts business in Utah, has an annual revenue of $25,000,000 or more and satisfies one or more of the following thresholds:

• During a calendar year, controls or processes personal data of 100,000 or more consumers; or

• Derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

N/A

Yes

Utah Consumer Privacy Act (UCPA)

To protect natural persons or consumers and sets out obligations for organizations regarding the processing of personal data, including transparency, consumer rights, and restrictions on certain data processing activities.

Any controller or processor who conducts business in Utah, has an annual revenue of $25,000,000 or more and satisfies one or more of the following thresholds:

• During a calendar year, controls or processes personal data of 100,000 or more consumers; or

• Derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

N/A

Yes

Virginia Consumer Data Protection Act (VCDPA)

To protect natural persons or consumers and requires organizations to implement obligations relating to the processing of personal data, including transparency, consumer rights, and restrictions on the processing of sensitive personal data.

The VCDPA applies to entities that conduct business in Virginia or produce products or services targeted to Virginia residents and that during a calendar year:

• At least 100,000 consumers; or

• At least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

N/A

Yes

Washington My Health, My Data (WMHMD)

To regulate the collection, sharing, selling, and processing of consumer health data by imposing obligations on regulated entities and small businesses operating in Washington and handling consumer health data.

Any business operating in Washington or targeting Washington consumers with products or services and determining the purpose and means of collecting, processing, sharing, or selling consumer health data. Unlike other state privacy laws, MHMD does not have a minimum number of consumer or revenue threshold for applicability.

It imposes requirements on "regulated entities" and "small businesses." Regulated entities do business in Washington or target Washington consumers and control the processing of consumer health data. Small businesses are regulated entities that meet specific revenue and consumer data processing thresholds.

N/A

Yes