The United States has no single national privacy law of the GDPR type. Federal rules are sector-based and security-driven, while a growing number of states, led by California, have their own consumer privacy laws. For foreign-owned businesses the main federal data issue is the Department of Justice Data Security Program, which controls access to Americans' bulk sensitive data by certain countries and their nationals.
Federal and state layers
Federal privacy law works by sector (for example health, financial services and children's online data) and through federal enforcement against unfair or deceptive practices. There is no federal rule that requires personal data to stay in the United States or that sets up a general transfer mechanism like the EU's adequacy system. Most consumer privacy obligations that look like GDPR come from state law.
California is the main example. The California Consumer Privacy Act (as amended by the California Privacy Rights Act) applies to businesses that cross any one of three thresholds, gives consumers rights to know, delete, correct and opt out of sale or sharing, and is enforced by both the Attorney General and a dedicated regulator, the California Privacy Protection Agency. New California regulations on cybersecurity audits, risk assessments and automated decision-making took effect on 1 January 2026. Many other states have passed comprehensive privacy laws with different thresholds and definitions, so a national business has to map state by state.1234
DOJ bulk sensitive data rule
Since 8 April 2025 the Department of Justice Data Security Program has worked like an export control on data. US persons may not sell or broker covered data to six countries of concern (China, Cuba, Iran, North Korea, Russia and Venezuela) or to covered persons linked to them. Vendor, employment and investment agreements that give such persons access to covered data are allowed only if specific security requirements are met, and due-diligence, audit and reporting duties apply.
The rule bites only above bulk thresholds measured over 12 months, which are low for genomic, biometric and location data. Foreign-parented groups should check whether a parent, affiliate, investor, vendor or employee counts as a covered person, because ordinary group arrangements such as shared IT services or offshore support teams can fall within the restricted categories.56789
Breach notification and cyber incident reporting
Every state, plus the District of Columbia and the main territories, has a breach notification law. Deadlines and the definition of personal information differ, so an incident affecting residents of several states triggers several regimes at once.
Listed companies must disclose material cyber incidents on Form 8-K within four business days of deciding the incident is material, and describe their cyber risk governance annually. A federal critical infrastructure reporting rule (72 hours for incidents, 24 hours for ransom payments) has been legislated but its final rule was not in force at the date of research.101112
| Data category | Threshold |
|---|---|
| Human genomic data | More than 100 US persons |
| Other human omic data | More than 1,000 US persons |
| Biometric identifiers | More than 1,000 US persons |
| Precise geolocation data | More than 1,000 US devices |
| Personal health data | More than 10,000 US persons |
| Personal financial data | More than 10,000 US persons |
| Covered personal identifiers | More than 100,000 US persons |
How it works, step by step
- Map which state privacy laws apply by revenue, volume of residents' data and data-selling activity1State attorneys general and, in California, the California Privacy Protection Agency
- Screen counterparties, investors, vendors and staff for countries of concern and covered persons, and measure data volumes against bulk thresholds67US Department of Justice, National Security Division
- Put CISA security requirements and the due-diligence and audit programme in place for any restricted transaction95US Department of Justice; CISA
- Prepare a multi-state breach response plan and, if listed, an SEC materiality assessment process1011State regulators; US Securities and Exchange Commission
No timings or fees are shown unless an official source states them.
Documents usually needed
- Privacy notice meeting California and other applicable state requirements
- Data inventory showing categories and volumes of US personal data
- Data Security Program screening records, data compliance programme and audit reports for restricted transactions
- Risk assessments and cybersecurity audit documents where California regulations apply
- Incident response plan covering state breach notices and any SEC filing
Common mistakes
- Assuming GDPR compliance covers US obligations; state laws use different definitions, opt-out rights and notice rules.
- Treating the DOJ Data Security Program as only a China issue; it also covers Cuba, Iran, North Korea, Russia and Venezuela and persons linked to them.
- Overlooking intra-group access, such as offshore engineering or support staff who are covered persons, under the restricted-transaction rules.
- Ignoring the 'sharing' of data for cross-context behavioural advertising, which California treats separately from sale.
- Waiting for a forensic report before starting the SEC materiality assessment; the four-day clock runs from the materiality decision.
When the business crosses borders
- There is no general federal restriction on sending personal data out of the United States, but transfers to countries of concern can be prohibited or restricted under the DOJ rule.
- EU and UK companies transferring personal data to US recipients rely on EU or UK transfer mechanisms; the US side has no equivalent general mechanism to manage.
- Foreign parents with access to US subsidiary data should check whether they or their staff are covered persons under 28 CFR Part 202.
Questions businesses ask
Is there a federal privacy law equivalent to GDPR?
No. Federal rules are sector-specific, and comprehensive consumer privacy laws exist at state level, with California's CCPA the most developed.1
Does the DOJ data rule apply to a European company?
It applies to US persons, which includes a US subsidiary and its staff. A European parent is not itself a country of concern, but the rule matters if data could reach covered persons through the group or its vendors.56
How fast must a listed company disclose a cyber incident?
Within four business days of determining that the incident is material, on Form 8-K Item 1.05 (Form 6-K for foreign private issuers).11
What this guide does not yet confirm
These points need checking with a qualified local professional in the United States before you rely on them.
- The current inflation-adjusted CCPA revenue threshold was not confirmed on an official page.
- The number and list of states with comprehensive consumer privacy laws in force at October 2026 was not confirmed on an official source.
- Phased compliance dates in California's 2026 regulations on risk assessments, cybersecurity audits and automated decision-making could not yet be checked.
- Federal sector laws (health, financial, children's privacy) and Federal Trade Commission enforcement were not separately source-checked.
- Status of the CIRCIA final rule should be re-checked; the CISA page wording appears dated.
- The Protecting Americans' Data from Foreign Adversaries Act 2024 (data brokers) was not source-checked.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The California Consumer Privacy Act applies to for-profit businesses doing business in California that have gross annual revenue over 25 million US dollars, or buy, sell or share personal information of 100,000 or more California residents or households, or derive 50% or more of annual revenue from selling California residents' personal information. State law (California), not federal. Any one threshold is enough. Nonprofits and government agencies are generally not covered. The revenue figure is adjusted for inflation by regulation; the current adjusted figure was not confirmed on the source page.
The Attorney General page states the statutory 25 million US dollar figure. The California Privacy Protection Agency adjusts this figure for inflation; check the Agency's current figure before relying on it.
Under the CCPA, consumers have rights to know, delete, correct, opt out of the sale or sharing of their personal information (including through a browser-based global privacy control) and limit the use of sensitive personal information. California residents. Rights are subject to statutory exceptions.
The CCPA is enforced by the California Attorney General and the California Privacy Protection Agency; consumers can sue directly only after certain data breaches caused by a failure to maintain reasonable security, with statutory damages of up to 750 US dollars per incident. Private action requires written notice and a 30-day cure period before suit. Applies to nonencrypted, nonredacted personal information.
California's regulations on cybersecurity audits, risk assessments and automated decision-making technology, together with other CCPA regulation updates, took effect on 1 January 2026. California. Adopted by the California Privacy Protection Agency board on 24 July 2025 and filed with the Secretary of State on 22 September 2025. Some obligations are phased in after 1 January 2026; the phased dates were not confirmed on the page read.
Phased compliance dates for risk assessment submissions, audit certifications and ADMT duties are in the approved regulation text, which could not yet be checked.
The US Department of Justice Data Security Program, issued under Executive Order 14117 and codified at 28 CFR Part 202, took effect on 8 April 2025 and prohibits or restricts certain transactions that give countries of concern or covered persons access to Americans' bulk sensitive personal data or US government-related data. Federal. Applies to US persons, including US companies and their staff. Due-diligence, audit and reporting duties for restricted transactions took effect on 5 October 2025 per the DOJ page.
The DOJ page gives 5 October 2025 for the affirmative compliance requirements; some secondary sources say 6 October 2025.
The countries of concern under the Data Security Program are China, Cuba, Iran, North Korea, Russia and Venezuela. Federal. China includes Hong Kong and Macau under the rule's definitions (not confirmed on the section read). Covered persons also include entities owned, controlled or directed by these countries and individuals primarily resident in them.
The eCFR is an authoritative but unofficial editorial compilation; the official text is the annual CFR edition and Federal Register.
Data Security Program bulk thresholds, counted over the preceding 12 months, are more than 100 US persons for human genomic data, more than 1,000 US persons for other human omic data and biometric identifiers, more than 1,000 US devices for precise geolocation data, more than 10,000 US persons for personal health or personal financial data, and more than 100,000 US persons for covered personal identifiers. Federal. Government-related data is covered regardless of volume.
The eCFR is an authoritative but unofficial editorial compilation; the official text is the annual CFR edition and Federal Register. The statement that government-related data is covered regardless of volume is from general knowledge of the rule and was not on the section read.
US persons may not knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person. Federal. Subject to exemptions and licences under 28 CFR Part 202.
The eCFR is an authoritative but unofficial editorial compilation; the official text is the annual CFR edition and Federal Register.
Vendor, employment and investment agreements that involve covered data and a country of concern or covered person are restricted transactions, permitted only if the US person meets the security requirements defined in the rule. Federal. The security requirements were issued by the Cybersecurity and Infrastructure Security Agency (CISA).
The eCFR is an authoritative but unofficial editorial compilation; the official text is the annual CFR edition and Federal Register.
All 50 states, the District of Columbia, Guam, Puerto Rico and the US Virgin Islands have laws requiring notification of individuals when a security breach involves personal information. State and territorial laws; definitions, deadlines and regulator notice duties differ by state.
NCSL is a non-governmental organisation serving state legislatures; no single federal page lists all state breach laws.
Companies registered with the US Securities and Exchange Commission must report a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining that the incident is material. Federal; SEC registrants only. Foreign private issuers report on Form 6-K. Annual disclosure of cybersecurity risk management and governance is required in Form 10-K (Regulation S-K Item 106) or Form 20-F. Delay possible where the Attorney General finds a substantial risk to national security or public safety.
The final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 has not been issued; once in force, covered entities will have to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. Federal; critical infrastructure entities as defined in the final rule. Reporting is voluntary until the rule takes effect.
The CISA page describes the effective date as yet to be determined, but parts of its wording appear dated; confirm the rule's status before relying on this.
Questions on this topic
12 statements on data protection, cross-border data and cybersecurity in the United States
