6 things to do when data privacy laws change

Short answer: data privacy laws in the US keep changing at the state level, and several changes in 2026 and 2027 matter to Louisiana organizations. On May 29, 2026, Louisiana became the 22nd state to enact a comprehensive consumer privacy law, and it takes effect January 1, 2027. For most smaller organizations, though, the rules that already apply, such as breach notice and industry rules like HIPAA and the FTC Safeguards Rule, matter more than the new one.

The US still has no single national privacy law. States keep passing their own, and federal sector rules do the rest.

State privacy laws in 2026 and 2027: the timeline

Several states also added bans on selling precise geolocation or sensitive data this year.

Does Louisiana’s new privacy law apply to you?

The Louisiana Data Privacy Act (Senate Bill 386) applies to businesses that operate in Louisiana or target Louisiana residents and meet at least one of these tests:

• Annual gross revenue over $25 million.
• Buying, receiving, selling or sharing personal data of 75,000 or more consumers, households or devices a year.
• Getting 50% or more of annual revenue from selling personal data.

It exempts HIPAA covered entities and business associates, financial institutions regulated under the Gramm-Leach-Bliley Act, nonprofits and higher education. The Attorney General enforces it, with civil penalties of up to $5,000 per violation and a 30-day cure period available only through July 31, 2027. Many small Louisiana organizations will fall outside it, and the exempt ones are exempt because HIPAA or GLBA already ask more of them.

What applies now, whatever your size

Louisiana’s existing breach law, La. R.S. 51:3074, already applies to any business that holds residents’ personal information. It requires reasonable security procedures and notice to affected residents within 60 days of discovering a breach. On the federal side, the FTC Safeguards Rule covers many non-bank financial businesses, including tax preparers and accounting firms, and requires notice to the FTC within 30 days for incidents involving 500 or more consumers. HIPAA covers healthcare.

HHS proposed a major HIPAA Security Rule update in January 2025 that would make encryption, multifactor authentication and regular vulnerability scanning explicit requirements. It is not final, and HHS has moved its target to July 2027. If your practice already has MFA, encryption, tested backups and a current risk analysis, you will have little to scramble on when a final rule lands. See our healthcare IT page for our approach.

Six things to do when data privacy laws change

1. List every rule that applies to you

Look at four angles: your industry (HIPAA, the FTC Safeguards Rule, attorney confidentiality, PCI DSS if you take cards), where your customers live, your contracts (business associate agreements and client security requirements), and the data you hold, since health, financial, children’s and biometric data carry extra rules. Our guide to small business compliance helps sort this out.

2. Assign someone to watch for changes

Sign up for updates from the agencies that regulate you and your professional association, and send them to at least two people so a vacation doesn’t mean a missed change. Your IT provider and attorney belong on the list of people who flag changes for you.

3. Review your security controls every year

New laptops, a new cloud app or a new employee’s phone can put you out of compliance without anyone noticing. Review MFA, encryption, backups, patching and logging at least yearly against what your rules require. When a client onboards with us, Chad Odom, our owner, performs and signs that first review against our 14-page checklist.

4. Update your written policies

Review them yearly and whenever a rule changes, with extra attention to your incident response plan, since notice deadlines differ by law. We write retention, BYOD, work from home and acceptable use policies for our clients, and our guide to data retention policies is a good place to start.

5. Fix gaps before the deadline

Check technical safeguards (systems and settings), administrative ones (policies, training and vendor contracts) and physical ones (locks, badge access, where devices are kept). Most new requirements touch all three.

6. Train staff and keep the records

Tell employees about changes that affect their daily work, fold privacy into regular security awareness training, and log the date, who attended and what was covered. Our clients’ phishing simulation results are reported to them as they happen, which makes that record easier to keep.

Trends worth watching

• AI and automated decisions. If you use AI tools with customer or employee data, write down what they are used for and who reviews the results. Our post on AI governance covers the basics.
• Opt-out signals. If your website runs advertising or tracking tools, ask your web team whether it honors universal opt-out signals.
• Where your data lives. Clients and regulators increasingly ask where data is stored and which vendors can reach it.
• Employee monitoring. Keep it focused on company systems and data, and tell staff what is monitored. Our guide to employee monitoring has the details.

Most of keeping up is having the right controls in place and the paperwork to prove it. Book a 15-minute call and we’ll work out which of these laws reach your business and what has changed since your last review. You can also read about our compliance services and our work with small and mid-size businesses.

Related reading: Third-party risk management: Securing your supply chain as a small business, What is data governance? A practical guide for small businesses and Security log management: Event logging best practices for a small business.

Frequently asked questions

How many states have data privacy laws?

When Louisiana’s governor signed its law on May 29, 2026, Louisiana became the 22nd state with a comprehensive consumer privacy law. Indiana, Kentucky and Rhode Island laws took effect January 1, 2026; Louisiana and Oklahoma follow on January 1, 2027, and Alabama on May 1, 2027.

Does the US have a federal data privacy law?

The US has no single national privacy law. Federal rules cover specific sectors instead, such as HIPAA for healthcare and the FTC Safeguards Rule for many non-bank financial businesses, including tax preparers and accounting firms. States fill in the rest with their own privacy and breach notice laws.