As of now, 12 states (CA, CO, CT, DE, IA, IN, MT, OR, TN, TX, UT, and VA) have passed comprehensive privacy laws that are in effect (CA, CT, CO, and VA), or are about to go into effect sometime soon (DE, IA, IN, MT, OR, TN, TX, and UT). If any of these laws apply to your business, it is important to note that each impose special requirements when it comes to processing what they respectively treat as sensitive personal information (also referred to as “sensitive data,” a type of “personal data” under some laws). These 12 states have adopted three different approaches to processing sensitive personal information (SPI).
