NewsHow to Build a Data Privacy and Cybersecurity Program
Build a U.S. data privacy and cybersecurity program with practical steps for governance, risk management, controls, employee training, and compliance.
A data privacy compliance checklist helps a business review how it collects, uses, stores, shares, and deletes personal information. It should cover the laws that apply, staff duties, privacy notices, consumer rights, vendors, security, and training.
Having a privacy policy is only a start. Your website, records, software, and staff must support what that policy says.
This guide is for U.S. business owners, compliance managers, HR teams, and IT staff. Use it to find gaps and plan action. Requirements depend on your business, the people whose data you handle, and the laws that cover that work. It is a review tool, not a guarantee of compliance.
Your Data Privacy Compliance Checklist at a Glance
Need help putting this checklist into practice? US Compliance Institute’s Data Privacy And Cybersecurity Compliance Certification can help you build the skills to review privacy rules, manage personal data, oversee vendors, and prepare for incidents.
Start with the privacy and cybersecurity compliance course if these tasks are new to you or your team needs a shared foundation. Then use the checklist below to apply the learning to your own systems and procedures.
Start with these 12 checks: laws, roles, data mapping, collection and retention, notices, consent and opt-outs, privacy requests, vendors, security, risk reviews, breach response, and staff training.
For each check, record one status:
-
Complete: The relevant procedure is in place, and you have checked that it works.
-
Needs Work: A gap needs an owner and a due date.
-
Not Applicable: You have a clear, recorded reason why the item does not apply.
Keep the results in a shared record that the right staff can access. A checked box is useful only when it reflects what happens in practice. Record open questions too, so they do not get lost between teams.
Which Privacy Requirements Apply to Your Business?
Start with your activities and data. Your office address alone does not settle which rules apply. Serving people in another state can bring that state’s law into scope, depending on its coverage rules.
For a starting point, our explanation of data privacy compliance introduces the responsibilities behind this checklist.
Review these areas:
-
State coverage: Check where people live, what you do with their data, and the law’s thresholds. California’s current revenue threshold is over $26,625,000. Its other routes include buying, selling, or sharing data of 100,000 or more consumers or households, or earning at least 50% of annual revenue from selling or sharing consumer data. These sit within other coverage conditions and exemptions in the CCPA scope guide.
-
Your sector: Healthcare organizations should establish who must follow the HIPAA Privacy Rule. HIPAA covers defined entities and business associates. Financial firms may have separate duties.
-
Sensitive data: Health data, children’s information, fingerprints, and exact location may need added checks. Health data outside HIPAA can still fall under laws such as Washington’s consumer health data law.
-
Staff and business contacts: Do not assume every state treats these records like consumer records. Check the law’s definitions.
-
Overseas work: GDPR may apply when you target services to people in the European Economic Area or monitor their behavior there. Use the EDPB’s scope guidance.
-
Exemptions: Check whether an exemption covers the organization, certain data, or a specific activity. It may not remove all privacy duties.
What Changed for Privacy Compliance in 2026?
Revisit your review even if your business has not changed. These selected updates may change its scope or procedures.
Indiana, Kentucky, and Rhode Island: Their privacy laws took effect on January 1, 2026. Check the Indiana guidance, Kentucky privacy guidance, and Rhode Island law against your business activities. Their coverage and duties differ.
California: Updated regulations took effect on January 1, 2026. Businesses subject to the risk assessment rules must assess covered activities. Updated procedures also require a way to confirm sale or sharing opt-out status, including requests sent through Global Privacy Control. Review the agency’s 2026 checklist of changes.
Some California deadlines come later. Rules for covered uses of technology to make significant decisions begin January 1, 2027. Initial cybersecurity audit certifications are due in phases from April 1, 2028, through April 1, 2030, for businesses that meet the audit criteria. The agency’s deadline summary explains these separate schedules. A later filing date does not remove duties that already apply.
Children’s online privacy: Most amended COPPA provisions had an April 22, 2026 compliance deadline. Covered operators should review consent, security, and retention practices against the amended children’s privacy rule. The federal rulemaking record confirms the date.
Connecticut: July 2026 changes expanded coverage. Current Connecticut guidance lists routes involving at least 35,000 consumers, sensitive data, or offering data for sale, subject to the law’s conditions and exclusions. Recheck coverage rather than relying on an older customer-count threshold.
The 12-Step Data Privacy Compliance Checklist
For each step, ask: What must we do? Who handles it? What records support it? Does it work? The owners below are suggestions. Set roles that fit your business. Legal duties apply only where the relevant law covers you; suggested tests help check that a procedure works.
1. Document Which Privacy Laws Apply
List the states you serve, the kinds of data you use, and your reasons for using them. Note relevant federal rules and overseas activities. Check coverage conditions and exemptions before deciding that a law applies or does not apply.
Keep a dated record of your decisions and the sources used. Review it when you enter a new market, add a service, or change data use.
Suggested owner: Compliance or legal.
Keep and test: Save the coverage record. Pick one new business activity and check whether the record addresses it. Send unclear cases for legal review rather than guessing.
2. Assign Privacy Responsibilities
Choose someone to coordinate the privacy work. Then give each task a clear owner. HR may handle staff records; marketing may handle website tracking; IT may carry out deletion. Agree who makes decisions when those duties overlap.
A data governance framework can help clarify who owns information and who maintains the procedures around it.
Suggested owner: Leadership and compliance.
Keep and test: Save a role list, contacts, and escalation steps. Ask staff where they would send a privacy request or concern. Check that a backup can act when the main owner is away.
3. Map Personal Data Across Systems and Vendors
Create a data inventory: a list of the personal information your business holds and where it goes. Include forms, email, shared drives, HR tools, customer systems, paper files, and suppliers.
Record the source, purpose, storage location, people with access, and outside recipients. Look beyond the main system. Old exports and spreadsheet copies can hold data too.
Suggested owner: Data owners and IT.
Keep and test: Save the inventory and vendor list. Use fictional test data to trace one record from collection through storage, sharing, and deletion. Compare the route with your inventory and fix missing steps.
4. Limit Collection and Define Retention
Ask why each data field is needed. Remove fields that serve no clear purpose, after checking business and legal needs. Decide how long each record type should stay and why.
Do not keep everything forever. Also, do not delete records subject to a valid legal hold or another duty to retain them. A legal hold pauses normal deletion for relevant records.
Suggested owner: Data owners, legal, and IT.
Keep and test: Save a retention schedule and deletion records. Check a sample of records due for deletion. Confirm how copies, vendor systems, and backups are handled under the relevant rules.
5. Match Privacy Notices to Actual Practices
Compare your notices with what happens on your website and in your systems. Check what you collect, why you use it, who receives it, and how people can use their rights.
Review notices before changing data use. A copied template may describe tools or practices you do not have. The FTC can act against unfair or misleading privacy practices.
Suggested owner: Compliance and marketing.
Keep and test: Keep notice versions and review dates. Check a form and a tracking tool against the notice. Correct any gap between the promise and actual practice.
6. Test Consent and Opt-Out Controls
Check when consent is required and which opt-outs you must offer. These rules vary by law, data type, and use. One cookie banner does not answer every privacy question.
Where required, honor browser signals such as Global Privacy Control. Check the systems and vendors involved in the covered activity, so a choice reaches more than the visible website button.
Suggested owner: Marketing, product, and IT.
Keep and test: Save consent records and opt-out test results. Submit a test request and check the result in relevant vendor systems too. In California, do not require identity verification for a sale or sharing opt-out; follow the current regulations.
7. Build a Consumer Privacy Request Process
Give people clear ways to submit requests. Plan how to receive requests, check identity where needed, find records, carry out changes, and reply. Include appeals where required. Do not collect extra identity data without a need.
Set deadlines by law and request type. For example, California generally requires a full reply to access, deletion, and correction requests within 45 calendar days, subject to permitted extensions. Sale or sharing opt-outs have a different deadline in the CCPA FAQs.
Suggested owner: Privacy and customer support.
Keep and test: Keep a request log with dates, actions, and reasons. Run a fictional request through relevant systems and vendors, including any justified exception.
8. Review Vendor Contracts and Data Use
List vendors that receive personal data and the work they do. Check whether they use it only for your instructions or for their own purposes. A vendor’s role affects the terms and checks you need.
Review required contract terms, security duties, help with privacy requests, incident reporting, and return or deletion of data. Include other providers the vendor uses where relevant.
Suggested owner: Procurement and legal.
Keep and test: Save contracts, reviews, and vendor contacts. Ask one vendor to explain how it handles a deletion request. Check that its answer fits the agreement and your actual process.
9. Apply Appropriate Security Safeguards
Protect personal information against unauthorized access, loss, and misuse. Review access rights, account protection, encryption where appropriate, software updates, and warning signs of an incident. Match controls to the data and risks.
Financial institutions covered by the FTC rule should also use a Safeguards Rule checklist for their specific duties. Understanding how data privacy and cybersecurity work together helps connect appropriate data use with protection against unauthorized access.
Suggested owner: IT and security.
Keep and test: Save access reviews and control checks. Check that a former employee cannot access systems containing personal data. Confirm that only staff who need the information can use it.
10. Assess Sensitive Data and New Processing Risks
Before adding an AI tool, tracking service, or new data use, review the personal information involved. Check the purpose, risks to people, vendor terms, and applicable consent or assessment rules.
Give sensitive data extra attention. Health details, exact location, and biometric identifiers such as fingerprints can create risks beyond ordinary contact data. Some laws require a documented assessment before certain processing starts.
Suggested owner: Privacy, legal, and product.
Keep and test: Save assessment decisions, safeguards, and approvals where required. Pick a recent tool purchase and check that its personal-data use was reviewed before launch. Revisit the review when the use changes.
11. Prepare a Law-Specific Breach Response Plan
Set out how staff report a suspected incident, who investigates, and who decides on notices. Record notification triggers, recipients, and deadlines for each relevant law. Keep contact details current.
There is no single U.S. notification deadline. For example, HIPAA notices to affected people must generally go out without unreasonable delay and within 60 days of discovery of a breach of unsecured protected health information. Other duties can differ; consult the HIPAA breach guidance.
Suggested owner: Security, privacy, and legal.
Keep and test: Save the response plan and exercise notes. Run a short fictional incident exercise. Check that staff know how to escalate it promptly.
12. Train Staff and Review the Program
Teach staff the procedures they use in their jobs. Customer support needs to recognize privacy requests. Marketing needs to handle data choices. HR needs safe ways to manage staff records.
Use short scenarios to check understanding. Keep training records, but also check whether staff can apply the lesson. Set refreshers based on risks, role changes, and applicable requirements; there is no single training schedule for every U.S. business.
Suggested owner: HR, compliance, and department managers.
Keep and test: Keep completion records, scenario results, and follow-up actions. Ask staff to handle a fictional request. Review the program after new tools, incidents, or changes in the law.
How to Prioritize Your Next 30 Days
Use this suggested work plan to organize improvements. It does not extend legal deadlines or create a grace period.
Days 1–7: Confirm scope and task owners. Address urgent issues, such as exposed personal data or overdue requests. Record questions that need specialist help.
Days 8–14: Review the data inventory, notices, tracking tools, retention rules, and key vendors. Start with high-risk data and common workflows.
Days 15–21: Test consumer requests, opt-outs, deletion, and incident escalation. Record what failed, who will fix it, and when the fix is due.
Days 22–30: Address staff knowledge gaps. Save evidence of completed work and set the next review date. Report open risks to the person who can approve resources or make decisions.
If a serious issue needs action now, act now. The schedule is a planning aid, not a reason to wait.
Common Mistakes That Leave Privacy Gaps
Small gaps can spread across teams. Watch for these five mistakes:
-
Copying a privacy notice: Check that each claim matches your real data use.
-
Assuming small means exempt: Coverage can depend on the data or activity, not just business size.
-
Testing only the website: Check whether choices reach advertising tools and other relevant vendors.
-
Treating security as full privacy compliance: Secure storage does not settle whether collection, sharing, or use is allowed.
-
Counting certificates without checking skills: Ask staff to apply the procedure to a realistic task.
Another common gap is marking an item complete because a policy exists. Keep evidence that the procedure is used and tested. Record limits and exceptions so the next reviewer can understand your decision.
The NIST Privacy Framework can help organize privacy risk work. It is voluntary guidance, not a law or proof of compliance.
Build the Skills to Put the Checklist Into Practice
When gaps point to staff knowledge, structured training can help. US Compliance Institute’s Data Privacy And Cybersecurity Compliance Certification covers federal and state frameworks, data lifecycle management, incident response, vendor oversight, and ongoing review.
The course page lists three hours of on-demand learning, a self-paced format, and a certificate of completion after successful completion. Compare the course curriculum and training format with the tasks your team handles.
Use the training to build a shared understanding, then apply it to your own records, tools, and procedures. A completion certificate records learning; it does not certify that your business meets every privacy law. Keep working with the staff or advisers responsible for your specific requirements.
