SECURE Data Act

(a) Data security. A controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data and that are appropriate to the volume, sensitivity, and nature of such personal data.

(b) Rebuttable presumption. A controller has a rebuttable presumption to an alleged violation of this section if—

(1) the controller complies with a relevant code of conduct approved under section 8(a)(3) (or a relevant certification described in section 8(f)); or

(2) the controller has established, implemented, and maintained—

(A) data security practices appropriate to the state-of-the-art in administrative, technical, and physical data security practices for the protection of the confidentiality, integrity, and accessibility of personal data, including such a practice demonstrated by adherence to a widely accepted technical specification or through a third-party attestation; and

(B) a comprehensive data security program that reasonably conforms to a relevant Federal or widely accepted international risk management framework for identifying and protecting against data security risks, and for detecting, responding to, and recovering from data security events.