Articles

Multi-Jurisdiction Privacy Compliance: A Practical Guide for 2026

Osano Staff — Tue, 25 Aug 2026 18:15:24 GMT

The Scale of the Problem

Five years ago, the California Consumer Privacy Act (CCPA) was the only US data privacy law on the books. Today, figuring out “which laws apply to us” requires a spreadsheet—and it’s growing quickly.

7 Things Privacy Regulators Are Looking for on Your Website

Matt Davis, CIPM (IAPP) — Thu, 20 Aug 2026 17:37:05 GMT

In its most-recent enforcement report, the California Privacy Protection Agency (CPPA, or CalPrivacy) disclosed that it’s received over 12 thousand consumer complaints since the CCPA went into effect. Consumers are raising the alarm over data privacy practices, and regulators are listening.

Why Companies Are Leaving OneTrust in 2026

Osano Staff — Tue, 04 Aug 2026 18:48:17 GMT

Imagine you order an entree at a restaurant. What do you expect from your dining experience?

Inside the VDPOSA: Vermont’s Unique Take on Data Privacy

Matt Davis, CIPM (IAPP) — Tue, 28 Jul 2026 18:22:14 GMT

Vermont’s added its own patch to the privacy patchwork in the US–and it's certainly contributing to the patchiness. The Vermont Data Privacy and Online Surveillance Act (VDPOSA) mirrors other states’ privacy laws in many ways, but diverges on several significant points.

What Is CIPA, and Why Is Your Website Getting Sued?

Osano Staff — Wed, 01 Jul 2026 17:27:30 GMT

A law firm just audited your website. There wasn’t any advance notice, you didn’t know there was anything to audit. Nevertheless, now there's a demand letter in your inbox.

The Louisiana Data Privacy Act (LDPA): What to Know About Data Privacy Compliance on the Delta

Matt Davis, CIPM (IAPP) — Mon, 15 Jun 2026 15:21:59 GMT

Louisianans know how to let the good times roll–and nothing stops a good time dead in its tracks faster than a lack of privacy.

Wiretap Lawsuits: Why CIPA, the ECPA, and the CDAFA Are a Package Deal

Ashley Fowler — Tue, 09 Jun 2026 20:44:22 GMT

Your business and its website have been minding their own business, when all of sudden, you found yourself on the receiving end of a demand letter. The letter gives you an ultimatum: Pay up, or go to court. Allegedly, your website is in violation of not just one, but three separate laws.

The Opportunity in the Obligation: Why Data Privacy Is Marketing Strategy

Shane Coker — Wed, 27 May 2026 18:44:24 GMT

Originally published on ANA.net

The SECURE Data Act: A Federal Privacy Framework (But for Real This Time?)

Matt Davis, CIPM (IAPP) — Thu, 23 Apr 2026 17:34:22 GMT

They say the third time’s the charm, but we’d be surprised if that held true for this third major swing at comprehensive federal data privacy legislation.

The Alabama Personal Data Protection Act (APDPA): The US Patchwork Gets Patchier

Matt Davis, CIPM (IAPP) — Wed, 22 Apr 2026 15:12:37 GMT

Alabama has joined the growing list of states with a comprehensive data privacy law. The Alabama Personal Data Protection Act (APDPA) makes Alabama the 21st state to enact a comprehensive privacy framework. The law takes effect on May 1, 2027, giving businesses roughly a year to prepare.

Oklahoma's Data Privacy Law: What Businesses Need to Know About the Oklahoma Consumer Data Privacy Act

Matt Davis, CIPM (IAPP) — Tue, 24 Mar 2026 18:20:54 GMT

After nearly a decade of legislative attempts, Oklahoma has joined the growing ranks of states with a comprehensive consumer data privacy law, making it the 20th state with such a law on the books. The Oklahoma Consumer Data Privacy Act (OCDPA) takes effect on January 1, 2027, giving businesses roughly nine months to prepare.

DPDPA Rules: How India’s Privacy Law Will Be Put into Practice

Derek Glausser, CIPM/FIP (IAPP) — Fri, 27 Feb 2026 19:00:06 GMT

In our previous guide to India’s Digital Personal Data Protection Act (DPDPA), we explored the high-level architecture of India’s first comprehensive privacy law. Since the act’s 2023 enactment, the landscape has shifted from legislative theory to operational reality.

Q&A From Our 2026 Privacy Laws Webinar

Matt Davis, CIPM (IAPP) — Mon, 26 Jan 2026 22:24:01 GMT

Miss the most recent webinar from the Osano team? Did your question not come up during discussion? Don't worry: We've collated, condensed, and thematically grouped the questions from 2026 Privacy Laws: New Laws, Amendments, and More, and the Osano team has provided their answers here. Plus, you can watch the webinar recording free and on-demand here, or select clips! Let's dive in.

5 Emerging Data Privacy Trends in 2026

Matt Davis, CIPM (IAPP) — Thu, 08 Jan 2026 16:33:27 GMT

When can compliance professionals and business stakeholders expect data privacy to stop evolving year after year?

AI Compliance: Risk Management for Artificial Intelligence

Osano Staff — Mon, 15 Dec 2025 19:55:16 GMT

How would you feel if someone could take a photo of your face and learn who you are, where you live, and other intimate details about your life–all without even speaking to you?

What Is the Digital Omnibus Proposal?

Matt Davis, CIPM (IAPP) — Wed, 26 Nov 2025 20:20:04 GMT

What Is the Digital Omnibus Regulation Proposal?

Maybe you’ve heard–the EU has a bit of a reputation for excessive regulation.

2026 CCPA Amendments: New Privacy Rules in California

Matt Davis, CIPM (IAPP) — Tue, 04 Nov 2025 16:04:07 GMT

They say the only two certainties in life are death and taxes. Humbly, we’d like to propose a third: New California privacy rules.

Marketing Data Privacy: A Comprehensive Guide for 2025

Matt Davis, CIPM (IAPP) — Tue, 28 Oct 2025 18:03:08 GMT

Think of three marketing channels.

Got them in mind?

We’re willing to bet you didn’t picture newspapers, radio, or flyers. That’s because the vast majority of marketing these days is digital (social media, websites, email, etc.) And at the heart of every digital marketing channel lies one essential ingredient: data.

How Long Do I Have to Respond to a DSAR?

Matt Davis, CIPM (IAPP) — Tue, 09 Sep 2025 17:37:38 GMT

Famously, construction on the Sydney Opera House finished ten years after its original deadline, ballooning its cost from $7 million to $102 million.

DSAR Response Letter: How to Respond to a Subject Rights Request

Matt Davis, CIPM (IAPP) — Tue, 26 Aug 2025 15:45:00 GMT

If you’re not accustomed to handling data subject access requests (DSARs), then it’s understandable if you feel a bit nervous about responding. After all, there are all sorts of legal requirements involved and the potential for fines and penalties if you get it wrong.

Server-Side Tracking: What Is It, and How Does It Impact Privacy Compliance?

Matt Davis, CIPM (IAPP) — Tue, 19 Aug 2025 14:17:34 GMT

Tired of ad blockers, cookie deprecation, and opt-outs undermining your marketing efforts? You may be investigating server-side tracking as a way to grow your access to data.

Privacy Operations: Best Practices & Compliance Solutions

Osano Staff — Mon, 04 Aug 2025 16:13:21 GMT

With so much data flying around, it’s more essential than ever that personal information remain private. To help make sure of this, there are a growing number of regulations aimed at personal data protection—like the GDPR and CCPA, and a whole host of others. As a business, you must stay compliant with these or face serious consequences. This is where privacy operations come in.

What Is the Processing of Personal Data?

Matt Davis, CIPM (IAPP) — Thu, 31 Jul 2025 19:26:24 GMT

You never think about breathing air. Most of the time, you’re not consciously moving your legs as you walk. You don’t have to remind yourself to blink every few seconds.

Data Privacy Strategy: The Complete Compliance Guide

Osano Staff — Mon, 28 Jul 2025 16:00:00 GMT

Organizations often struggle with privacy in a regulatory landscape that can change at any point. However, the risk of data breaches is always rising, and awareness of privacy rights is growing. As a result, maintaining the privacy of user data is more important now than ever.

The Data Privacy Certification Guide

Osano Staff — Mon, 21 Jul 2025 19:08:03 GMT

Unless businesses start hiring psychics, certifications will continue to be a critical way for experts to prove that they know what they're talking about.

Taking Osano to the Next Milestone (and Beyond)

a@osano.com (Arlo Gilbert) — Mon, 14 Jul 2025 21:00:00 GMT

“What got you here won’t get you there.”

Customer Data Privacy & Consumer Data Privacy Laws

Osano Staff — Wed, 02 Jul 2025 15:11:04 GMT

Data privacy regulations aren’t known for being light reading.

5 Privacy Enforcement Trends to Watch Out For in 2025

Matt Davis, CIPM (IAPP) — Tue, 27 May 2025 12:45:48 GMT

Regulations matter, but until they’re enforced, they’re all just so many words (so, so many words) on paper. Businesses know that what really counts is whether, how, where, and when regulators enforce the law.

5 DSAR Trends Essential for Earning Trust

Matt Davis, CIPM (IAPP) — Thu, 15 May 2025 13:09:41 GMT

Data subject access requests (DSARs), or subject rights requests (SRRs), are evolving.

The Osano Privacy Enforcement Tracker Is Here: Fines, Penalties, and How to Avoid Them

Osano Staff — Wed, 07 May 2025 16:37:35 GMT

Introducing the Osano Enforcement Tracker! Use this tool to stay informed about the most recent privacy enforcement actions, identify patterns and trends, and report on privacy enforcement to your organization. Demonstrate the value of data privacy to your organization and maintain awareness into regulators' enforcement priorities.

Data Privacy in Healthcare: Compliance and Security | Osano

Osano Staff — Mon, 05 May 2025 12:41:38 GMT

Healthcare is a very personal experience. In order to receive the best care, individuals must share the most intimate details about themselves. For this reason, trust between patients and healthcare providers is crucial. Data privacy plays a key role in protecting this bond.

3 Ways GRC Pros Can Manage Privacy Risk (and Still Have Time to Sleep, Eat, and Relax)

Matt Davis, CIPM (IAPP) — Thu, 01 May 2025 14:06:59 GMT

Governance, risk, and compliance (GRC) can feel like thankless work at times. You can’t ship risk mitigation to market. It's not usually reflected on your balance sheet. Only especially canny investors notice the absence of risk.

How to Shift Data Privacy Left

Matt Davis, CIPM (IAPP) — Wed, 23 Apr 2025 14:36:38 GMT

The 1:10:100 rule—coined in 1992 by George Labovitz and Yu Sang Chang, the rule describes how much bad data costs. Preventing the creation of bad data at its source costs $1. Remediating bad data costs $10. Doing nothing costs $100.

AI Risk Management Frameworks

Osano Staff — Wed, 16 Apr 2025 15:04:30 GMT

In 2023, an Australian mayor was getting ready to take legal action against OpenAI. The reason? The company’s chatbot, ChatGPT, shared a fake story about him being involved in a bribery scandal.

Multi-Hyphenate Privacy Professionals: 3 Strategies for Success

Matt Davis, CIPM (IAPP) — Fri, 28 Mar 2025 18:04:08 GMT

When we write about data privacy, it’s easy to default to talking to “privacy professionals.”

How Osano Does DSARs

Matt Davis, CIPM (IAPP) — Fri, 14 Mar 2025 14:14:14 GMT

Subject rights requests can be confusing for everybody involved.

AI Governance & Why It Is Necessary

Osano Staff — Tue, 04 Mar 2025 16:00:00 GMT

In March 2023, Elon Musk and Steve Wozniak, along with other technology experts, signed an open letter asking that training powerful AI models be stopped until stronger AI governance laws could be developed. Two months later, Sam Altman, the CEO of OpenAI (the company behind ChatGPT), testified before Congress on AI risks and urged stronger AI regulations.

Privacy Governance & Data Privacy Frameworks

Osano Staff — Mon, 24 Feb 2025 19:58:44 GMT

Responsible organizations understand that privacy governance is essential for the systematic and compliant management of personal data and for maintaining customer and stakeholder trust. In a world where people increasingly have to fight for their right to privacy and where data breaches seem almost inevitable, it becomes even more necessary for organizations to establish a solid privacy governance framework.

Community in Privacy: Let’s Build it Together

Matt Davis, CIPM (IAPP) — Wed, 19 Feb 2025 23:25:02 GMT

Somedays, a privacy professional might feel a little less like an expert in data privacy compliance and protection and a little more like a lighthouse keeper: Alone at the edge of the world.

Osano’s Own Women in Privacy: Skye McCullough

Osano Staff — Thu, 13 Feb 2025 17:57:22 GMT

Our showcase of Osano’s Women in Privacy continues with our third profile: Meet Skye McCullough, Chief Customer Officer at Osano. Learn more about Skye below; if you haven’t had a chance, also check out our profiles of Head of Privacy Rachael Ormiston and Senior Privacy Program Manager Ashley Fowler.

Watch Osano's Ask a Privacy Pro Series

Osano Staff — Wed, 12 Feb 2025 19:30:14 GMT

There's a lot of uncertainty out there in the world of data privacy. Now, there's a little less.

Osano’s Own Women in Privacy: Ashley Fowler

Osano Staff — Tue, 11 Feb 2025 18:53:13 GMT

Welcome to the second installment of our three-part series profiling the Women in Privacy at Osano! We’re excited to feature Ashley Fowler, Osano’s Senior Privacy Program Manager. Ashley is another vital part of our Privacy Team.

Osano's Own Women in Privacy: Rachael Ormiston

Osano Staff — Mon, 10 Feb 2025 22:21:47 GMT

Wednesday Women’s Women in Privacy Series introduced the B2B world to dozens of incredible women protecting our personal and sensitive data inside organizations and advocating for consumer privacy rights. There are so many women leading the way in privacy: At Osano, they are legion. We are proud to say that women make up nearly 40 percent of Osano’s workforce. And the women who work hands-on as part of our privacy team, and who advise our customers on getting the best privacy protection from Osano, are some of the best in the business.

2 Major Obstacles Privacy Newbies Face (and How to Overcome Them)

Matt Davis, CIPM (IAPP) — Thu, 06 Feb 2025 15:40:26 GMT

Martial artists use a colored belt system to denote their expertise. You start with a white belt, and, as you train and improve, you eventually achieve the next color and corresponding rank. Once you’ve gained a black belt, you’re recognized as a true expert in your martial art. Urban legend has it that historical martial artists’ belts changed color as they were exposed to dirt, sweat, and blood, slowing changing from white to black over the course of years.

Data Privacy Automation: Complying with Ease

Osano Staff — Tue, 04 Feb 2025 07:45:00 GMT

When people say "data is the new oil," they're usually referring to its value. But in reality, oil requires careful handling, management, storage, protection, and processing before it can be turned into a truly valuable resource. The same can be said of data.

PII Compliance Requirements & Best Practices

Osano Staff — Mon, 03 Feb 2025 16:20:17 GMT

Businesses need data from consumers, and the sharing and selling of this resource has become quite common. However, you also need to be mindful of the rights of the people whose data you collect, especially their personally identifiable information (PII). In fact, if your business stores, processes, and shares consumer data, PII compliance is a legal requirement under numerous laws.

Don’t Mess with Texas: The First Lawsuit Under a State Data Privacy Law

Matt Davis, CIPM (IAPP) — Thu, 30 Jan 2025 14:35:16 GMT

“Don’t Mess with Texas.”

AI and Data Privacy

Osano Staff — Tue, 28 Jan 2025 13:52:53 GMT

The advent of artificial intelligence and, more notably, generative AI and large language models (LLMs) has raised alarms all over the world. As with any innovation, the world is split between those excited for the chances it unlocks and the dangers it may pose.

2025 US Privacy Laws: Frequently Asked Questions

Ashley Fowler — Thu, 16 Jan 2025 15:37:05 GMT

As the years go on, the privacy landscape just gets more complicated—2025 is no exception.

The EU Court Ruling on the Bindl Case: What It Means for Privacy Law

rormiston@osano.com (Rachael Ormiston) — Fri, 10 Jan 2025 22:52:46 GMT

At first glance, the headline looks like a typo: The EU rules against the EU…for breaching EU data protection law?