Data Breaches

9.

Legal and Regulatory Frameworks

9.1.

Major Data Protection Regulations

9.1.1.

General Data Protection Regulation (GDPR)

9.1.1.1.

Scope and Applicability

9.1.1.1.1.

Territorial Scope

9.1.1.1.2.

9.1.1.1.3.

Personal Data Definition

9.1.1.2.

9.1.1.2.1.

Lawfulness and Fairness

9.1.1.2.2.

Purpose Limitation

9.1.1.2.3.

Data Minimization

9.1.1.2.4.

9.1.1.2.5.

Storage Limitation

9.1.1.2.6.

9.1.1.3.

Individual Rights

9.1.1.3.1.

Right to Information

9.1.1.3.2.

Right of Access

9.1.1.3.3.

Right to Rectification

9.1.1.3.4.

Right to Erasure

9.1.1.3.5.

Right to Restrict Processing

9.1.1.3.6.

Right to Data Portability

9.1.1.4.

Breach Notification Requirements

9.1.1.4.1.

Authority Notification

9.1.1.4.2.

Individual Notification

9.1.1.4.3.

Notification Timelines

9.1.2.

California Consumer Privacy Act (CCPA)

9.1.2.1.

Consumer Rights

9.1.2.1.1.

9.1.2.1.2.

Right to Delete

9.1.2.1.3.

Right to Opt-Out

9.1.2.1.4.

Right to Non-Discrimination

9.1.2.2.

Business Obligations

9.1.2.2.1.

Disclosure Requirements

9.1.2.2.2.

Response Procedures

9.1.2.2.3.

Verification Processes

9.1.3.

California Privacy Rights Act (CPRA)

9.1.3.1.

Enhanced Consumer Rights

9.1.3.2.

Sensitive Personal Information

9.1.3.3.

California Privacy Protection Agency

9.1.4.

Health Insurance Portability and Accountability Act (HIPAA)

9.1.4.1.

9.1.4.1.1.

Protected Health Information

9.1.4.1.2.

Permitted Uses and Disclosures

9.1.4.1.3.

Individual Rights

9.1.4.2.

9.1.4.2.1.

Administrative Safeguards

9.1.4.2.2.

Physical Safeguards

9.1.4.2.3.

Technical Safeguards

9.1.4.3.

Breach Notification Rule

9.1.5.

Payment Card Industry Data Security Standard (PCI DSS)

9.1.5.1.

Compliance Requirements

9.1.5.2.

Security Controls

9.1.5.3.

Assessment Procedures

9.1.6.

Sarbanes-Oxley Act (SOX)

9.1.6.1.

Internal Controls

9.1.6.2.

9.1.6.3.

Financial Reporting

9.2.

Sector-Specific Regulations

9.2.1.

Financial Services

9.2.1.1.

Gramm-Leach-Bliley Act

9.2.1.2.

Fair Credit Reporting Act

9.2.1.3.

Bank Secrecy Act

9.2.2.

9.2.2.1.

9.2.2.2.

FDA Cybersecurity Guidelines

9.2.3.

9.2.3.1.

Family Educational Rights and Privacy Act

9.2.4.

9.2.4.1.

Federal Information Security Management Act

9.2.4.2.

Cybersecurity Framework

9.3.

International Frameworks

9.3.1.

ISO 27001/27002

9.3.2.

NIST Cybersecurity Framework

9.3.3.

Cloud Security Alliance Guidelines

9.4.

Compliance Requirements

9.4.1.

Risk Assessment Obligations

9.4.2.

Security Control Implementation

9.4.3.

Documentation Requirements

9.4.4.

Audit and Assessment

9.4.5.

Training and Awareness

9.5.

Legal Consequences

9.5.1.

Civil Penalties

9.5.2.

Criminal Charges

9.5.3.

Regulatory Actions

9.5.4.

Private Litigation

Previous

8. Incident Response and Management

Go to top

Next

10. Analysis of Major Data Breaches