Sarbanes-Oxley Act (SOX): Federal regulation governing financial records retention and corporate accountability. Requires companies to maintain accurate financial records and implement internal controls for data backup.
Health Insurance Portability and Accountability Act (HIPAA): Federal regulation for healthcare data protection requiring specific backup and retention policies for protected health information (PHI).
Gramm-Leach-Bliley Act (GLBA): Federal regulation for financial institutions requiring safeguards for customers' personal financial information and appropriate data backup measures.
Fair Labor Standards Act (FLSA): Federal regulation requiring retention of employment records, including payroll data and time records.
Federal Rules of Civil Procedure (FRCP): Federal rules governing electronic discovery requirements and the preservation of electronically stored information for legal proceedings.
Payment Card Industry Data Security Standard (PCI DSS): Industry standard for organizations handling credit card information, specifying requirements for secure data backup and retention.
Family Educational Rights and Privacy Act (FERPA): Federal law protecting the privacy of student education records, including requirements for secure storage and retention.
State Data Breach Notification Laws: Various state-specific requirements for maintaining and protecting data to prevent breaches and notification requirements in case of data compromise.
State Data Retention Requirements: State-specific laws governing how long different types of data must be retained and secured.
California Consumer Privacy Act (CCPA): California's comprehensive privacy law requiring specific data protection measures and giving consumers rights over their personal information.
NY SHIELD Act: New York State's law requiring businesses to implement safeguards for private information of NY residents, including specific data security and backup requirements.
General Data Protection Regulation (GDPR): European Union regulation that may apply to US companies handling EU residents' data, requiring specific data protection and retention measures.
