SECURE Data Act Proposes National Standard for Privacy
SECURE Data Act Proposes National Standard for Privacy
https://natlawreview.com/article/america-finally-getting-national-data-privacy-law
Publish Date: 2026-05-07 12:41:00
Source Domain: natlawreview.com
A sweeping new federal legislative proposal could reshape how American companies collect, use, and profit from consumer data. Here is what you need to know.
Your compliance team is already toggling between 20+ state privacy laws—one spreadsheet for California, another for Texas, a third for Colorado. Meanwhile, every smartphone app is quietly sharing location data, health metrics, and browsing history with dozens of third parties. For businesses, it is an operational nightmare. For consumers, it is an invisible free-for-all. That may be about to change.
On 21 April 2026, House Republicans released the SECURE Data Act (H.R. 8413) (the Act), the most comprehensive attempt yet to create a national data privacy standard. Paired with the GUARD Financial Data Act (H.R. 8398), which covers financial institutions under the Gramm-Leach-Bliley Act, the two bills aim to eliminate gaps and overlaps in consumer data protection across the entire economy.
What Rights Would Consumers Get?
The Act would codify enforceable privacy rights against data controllers—persons that determine the purpose and means of processing personal data (financial institutions subject to the Gramm-Leach-Bliley Act are separately exempt). Consumers would gain the right to access, correct, delete, and port their data, and to opt out of targeted advertising, data sales, and profiling decisions with significant effects.
Controllers would need to respond to verified requests within 45 days. Consumers may submit two free requests per right per year. Controllers would also need to establish an appeals process for denied requests. These are not aspirational principles, they would be enforceable, uniform, nationwide rights.
Data Minimization: No More “Collect Everything, Figure It Out Later”
Perhaps the most operationally significant provision is data minimization. The Act would limit collection to what is “adequate, relevant, and reasonably necessary in relation to each purpose for which the data…
