SECURE Data Act: what it means for privacy programmes now

TL;DR: The SECURE Data Act would create a national consumer privacy framework with access, correction, deletion, portability and opt-out rights, according to Osano, while also preempting state laws and leaving AI and privacy impact assessments largely untouched. The bill could simplify compliance, but its ceiling-style preemption and weak enforcement design keep it politically fragile and operationally incomplete.

Editorial analysis by NHI Mgmt Group, based on content published by Osano: “The SECURE Data Act: A Federal Privacy Framework (But for Real This Time?)”.

Key questions

Q: How should privacy teams prepare for a federal privacy law when state privacy rules are still multiplying?

A: Privacy teams should build a program that can absorb baseline federal requirements while still tracking state-level exceptions, sector-specific rules, and enforcement differences.

Q: Why do privacy rights depend so heavily on identity verification and data lineage?

A: Because access, correction, deletion, and portability only work when the organisation can reliably identify the requester and locate the relevant data.

Q: When should organisations treat AI governance as part of privacy governance?

A: Organisations should treat AI governance as part of privacy governance whenever AI systems process personal data, influence decisions, or depend on delegated access to connected systems.

Practitioner guidance

• Map consumer-rights workflows end to end Trace how access, correction, deletion, and portability requests move through identity proofing, ticketing, data discovery, and fulfilment systems so each step can be evidenced.
• Review controller and processor boundaries Document which teams own collection, processing, disclosure, and deletion decisions so the federal model can be mapped cleanly to internal accountability.
• Assess state-law dependencies now Identify where current controls depend on state privacy carve-outs or stricter state requirements, because a federal ceiling would change those assumptions quickly.

Bottom line: The SECURE Data Act would harmonise core consumer privacy rights, but its preemption model makes the political and operational trade-offs unusually sharp.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →