While there is no unitary law for cybersecurity and data protection in Germany, the cyber security landscape is held together by a combination of federal and European laws and regulations. Like every European country, Germany’s data protection is governed and enforced by the strict EU-GDPR.

The U.S. Federal Government passed the Computer Fraud and Abuse Act (18 U.S.C.§1030) (CFAA) in 1986 as an amendment to the Comprehensive Crime Control Act of 1984, which included the first federal computer crime statute. Since enacting the CFAA, congress and the federal government have amended the act multiple times to extend its reach and impose criminal and civil liability on additional malicious computer activities.

The Fair Credit Reporting Act (FCRA) is a U.S. federal law regulating consumer credit information collection, dissemination, and use by consumer reporting agencies. Understanding the FCRA is vital for organizations directly utilizing consumer credit information and individuals who want to exercise their rights over their personal credit information. Monitor your organization’s attack surface and stay FCRA compliant with UpGuard BreachSight >

By now you’ve heard about the new cybersecurity rules from the U.S. Securities and Exchange Commission (SEC) requiring public companies to report material cybersecurity incidents and disclose critical information related to cybersecurity risk management, expertise, and governance. Companies will be required to disclose risks in their annual reports beginning on December 15, 2023.

In 2016, the European Commission adopted the EU Network and Information Security (NIS) Directive. The directive aims to establish regulations that improve the overall cybersecurity level across Europe and was recently updated in January 2023 to a new directive called NIS2. The NIS Directive is a multifaceted legislation that applies to various industry sectors, providing regulations that help EU member states build strong cybersecurity postures.

In a world where cybersecurity threats are increasingly prevalent, the U.S. Securities and Exchange Commission (SEC) has taken a significant step towards ensuring transparency and accountability in how companies manage these risks. The SEC has adopted new rules requiring companies to disclose material cybersecurity incidents and provide annual updates on their cybersecurity risk management, strategy, and governance.

Australia is using the Security of Critical Infrastructure Act 2018 (SOCI Act 2018) as a framework to help the country mitigate and remediate threats to the country’s critical infrastructure. This comes after several high-profile cyber attacks raised Australia’s awareness of the need for cybersecurity and the standardization of cyber security measures for priority organizations.

The Massachusetts Data Security Law (201 CMR 17.00) safeguards the personal information of Massachusetts residents. The law went into effect on March 1, 2010, and at the time, was one of the most comprehensive data privacy laws passed in the United States. Since the law’s passing, a variety of U.S. States have passed more robust data privacy legislation, including the notable California Consumer Privacy Act (CCPA) and Virginia Consumer Data Privacy Act (VCDPA).

Washington’s My Health My Data Act (MHMD Act) regulates businesses and service providers that process or collect consumer health data from state residents. The act’s broad definition of “health data” carries compliance implications for a wide range of entities, including many that fall outside the scope of the Health Insurance Portability and Accountability Act (HIPAA).