Data privacy regulation consists of laws governing how organizations securely collect, store, process, use, retain, and delete information about individuals. It also defines the rights people can exercise over that information. section 8.2.1
Typical regulatory obligations include:
- Define personal and sensitive data, including identifying information such as names, addresses, phone numbers, email addresses, and IP addresses. section 8.2.1
- Limit access, collect data for a specific purpose, and retain it only as long as necessary. section 8.2.1
- Inform individuals about collection and use, support deletion requests, and allow consent to be denied for specific uses. section 8.2.1
Requirements vary by region. The European Union’s GDPR governs personal-data collection, retention, use, and related individual rights; analytics teams commonly coordinate compliance with IT, security, and legal teams. section 8.2.1
Figure 8.3 Many types of sensitive information are governed by sector-specific laws, both in the US, as in the examples shown here, and around the world.
Sector-specific laws govern different kinds of sensitive information across the United States and other regions. section 8.2.1
