State Data Security Laws
About two-thirds of states require data security measures. Roughly 20 states use a 'reasonable security' standard (e.g., California's AB 1950); about 10 impose prescriptive requirements (Massachusetts is the most prescriptive); and Connecticut, Iowa, Ohio, and Utah use safe harbor laws instead.
Less well known than breach laws, state data security laws require companies to develop and maintain appropriate data security. Federally, no law imposes security standards across all industries, but the health care and financial sectors have federal security provisions, and the FTC uses its Section 5 power to challenge misrepresented security (deceptive) or a failure to provide reasonable procedures (unfair).
| Approach | Roughly how many states | Example |
|---|---|---|
| Reasonable security standard (no specifics) | ~20 states | California AB 1950 |
| Prescriptive/extensive requirements | ~10 states | Massachusetts (most prescriptive: authentication, access controls, encryption, monitoring, firewalls, updates, training) |
| Cybersecurity safe harbor instead of obligations | 4 states | Connecticut, Iowa, Ohio, Utah |
Some states impose sector-specific security mandates (e.g., financial services, insurance). New York has the most prominent of these.