Regulatory
Compliance and regulatory guidelines
GLBA Safeguards Rule
15 U.S.C. §6801 · 16 CFR Part 314
- What it is
- The security half of the Gramm-Leach-Bliley Act. It requires a written information security program, a named individual accountable for it, a written risk assessment, and documented oversight of service providers.
California Insurance Code §791
Insurance Information and Privacy Protection Act
- What it is
- The insurance-specific privacy statute. It governs how insurance information is collected, disclosed and used, sets out when authorisation is required, and defines a category called an insurance-support organization.
Cal-FIPA
Cal. Fin. Code §4050–4060
- What it is
- California's Financial Information Privacy Act, which sets a stricter bar than GLBA on sharing: affirmative consent rather than an opportunity to opt out.
SOC 2
AICPA Trust Services Criteria
- What it is
- A framework of criteria — security, availability, processing integrity, confidentiality and privacy — against which an independent CPA firm examines a service organization and issues a report. A Type I report covers whether controls were suitably designed at a point in time; a Type II covers whether they operated effectively across a period, usually three months or longer.
CCPA / CPRA
Cal. Civ. Code §1798.100 et seq.
- What it is
- California's consumer privacy law, as amended by the Privacy Rights Act. It grants rights to access, delete, correct and opt out, requires notice at collection, and expects retention periods to be stated rather than open-ended.