U.S. Data Storage Compliance: Federal and State Rules

The short answer

The United States has no single law that covers all data storage. Obligations depend on the industry, the type of data and the residents whose data you handle.
All states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information, according to the FTC.
The CCPA applies to for-profit businesses that do business in California and have annual revenue over $25 million, or handle the personal information of 100,000 or more California residents or households, or earn 50% or more of revenue from selling it.
The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices and to safeguard sensitive data.
This is general information, not legal advice: ask a privacy attorney which rules apply to your business.

Table of contents

Where the rules come from
Federal rules by sector
State breach notification laws
State privacy laws: the California example
State security laws: the New York example
What to do
If you serve customers outside the United States
What MyUSAService offers
Frequently asked questions

If your business stores customer or employee data, the rules that apply to you depend on what you store, who the data belongs to and which industry you are in. There is no single U.S. law to check: there is a set of federal rules by sector, and state laws that follow your customers.

This guide gives the map. It is general information, not legal advice: for your case, ask a privacy attorney.

Where the rules come from

Source	What it covers	Who it applies to
Federal sector laws	Financial data, health data, children’s data and others	Businesses in the regulated sector
State breach notification laws	What to do when personal information is compromised	Businesses holding personal information of a state’s residents
State privacy laws	Consumer rights over personal data, such as access and deletion	Businesses that meet each law’s thresholds
State security laws	Reasonable safeguards for private information	Businesses holding the information of the state’s residents
Contracts	Security terms set by customers, platforms and partners	The parties to each contract

Most of these rules concern how you protect and handle data, not the physical place where servers are. Contracts and some sector rules can add requirements about location. [Probabile]

Federal rules by sector

The Federal Trade Commission explains that the Gramm-Leach-Bliley Act requires financial institutions, meaning companies that offer consumers financial products or services such as loans, financial or investment advice, or insurance, to explain their information-sharing practices and to safeguard sensitive data.

Other federal laws cover health information and children’s data, among other areas. If your business handles health information or serves children online, ask a lawyer whether those laws apply to you.

State breach notification laws

According to the FTC, all states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted laws requiring notification of security breaches involving personal information. The FTC also notes that, depending on the type of information involved, other laws may apply as well.

These laws differ on what counts as personal information, on the deadline to notify and on who must be told. If your customers are in several states, the laws of each state can apply.

State privacy laws: the California example

California’s Consumer Privacy Act gives residents rights such as the right to know what personal information a business collects, the right to delete it, with exceptions, and the right to opt out of its sale or sharing. According to the California Attorney General, it applies to for-profit businesses that do business in California and meet any of these conditions:

Annual gross revenue of over $25 million.
Buying, selling or sharing the personal information of 100,000 or more California residents or households.
Earning 50% or more of annual revenue from selling California residents’ personal information.

The Attorney General also explains that consumers can sue only in the case of certain data breaches, when their unencrypted and non-redacted personal information was stolen because of a failure to maintain reasonable security. Statutory damages can reach $750 per incident, after a notice and a 30-day cure period.

Other states have their own privacy laws, with their own thresholds. Check each state where you have many customers.

State security laws: the New York example

New York’s SHIELD Act strengthens the state’s data-security laws, and its Attorney General handles reports of data breaches, including breaches that compromise consumers’ personal information. If you hold private information of New York residents, review the Act.

What to do

Map your data. What do you collect, where is it stored, who can access it, and which tools and vendors touch it?
Collect less. Data you never collect cannot be lost.
Protect what you keep. Encryption, strong passwords with multi-factor authentication, updated software and backups.
Limit access. Give each person access only to what the role needs, and remove access when someone leaves.
Check your vendors. Your cloud, payment and email providers hold data for you: read their security terms and their breach commitments.
Write a privacy policy that matches what you actually do, and keep it current.
Prepare a breach plan. Who investigates, who decides, who notifies and by when. The FTC guide on responding to breaches is a good start.
Set retention periods. Keep tax and accounting records as long as the IRS requires: generally at least 3 years from filing, longer in specific cases. Delete marketing and other data you no longer need.

See our guides on bookkeeping and payroll compliance for the records you must keep.

If you serve customers outside the United States

Other countries have their own data protection laws, which can apply to you when you sell to their residents. This guide does not cover them.

What MyUSAService offers

MyUSAService forms and maintains U.S. companies for owners abroad. We do not provide legal or privacy compliance services: work with a privacy attorney for your data obligations, and with us for the company side. Prices of our services are dated September 2026.

Frequently asked questions

Is there a federal law that covers all data storage in the U.S.?

No. There are federal laws by sector, and every state has its own breach notification law, among other state rules.

Do I have to notify customers if their data is stolen?

Every state has a breach notification law. The details differ by state, so check the laws of the states where your customers live.

Does the CCPA apply to my business?

It applies to for-profit businesses that do business in California and meet one of three conditions: over $25 million in annual revenue, 100,000 or more California residents or households, or 50% or more of revenue from selling personal information.

Where do I have to store my data?

Most laws focus on how data is protected and handled. Contracts and some sector rules can add location requirements.

How long should I keep business records?

Tax records: generally at least 3 years from filing, longer in specific cases. Other data: only as long as you need it.

Sources

First published July 22, 2025. This article is general information, not tax advice for your situation. MyUSAService packages and prices | Book a free call