Data Privacy Audit in the USA

A data privacy audit in the USA is an independent review of how your organisation handles personal data against the laws that apply to you — California’s CCPA/CPRA and the growing set of state privacy laws (Virginia, Colorado, Connecticut, Texas and more), plus sector rules like HIPAA and GLBA. We map your data, test consumer rights and opt-outs, review vendor and transfer arrangements and breach readiness, and hand you a prioritised, audit-ready report.

Which data-protection laws apply to you in the USA?

The US has no single federal privacy law; obligations come from a patchwork of state statutes and sector rules. An audit is only useful if it is scoped to the states and sectors that actually apply to you:

• California CCPA/CPRA — the most demanding state regime, enforced by the California Privacy Protection Agency (CPPA): consumer rights, opt-outs of sale/sharing, and security obligations.
• Other state laws — Virginia (VCDPA), Colorado (CPA), Connecticut, Texas and a growing list, each with its own rights, thresholds and opt-out signals.
• Sector rules — HIPAA for health data and GLBA / the FTC Safeguards Rule for financial data, which apply regardless of state.
• Breach-notification laws — all 50 states have their own, with differing triggers and timelines, which we factor into your incident playbook.

What a CyberSigma USA privacy audit actually covers

We audit how personal data actually moves through your organisation against the law, not just your policy documents. In a typical engagement we:

• Map your personal data: build or validate a Record of Processing Activities (ROPA) and data-flow inventory, including what leaves the country.
• Test lawful basis and consent: how you collect, record and let people withdraw consent, and whether your lawful bases actually hold up.
• Check notices and transparency: do your privacy notices match what you really do with data?
• Exercise data-subject rights: walk a real access, correction, deletion and objection request through your process against the statutory clock.
• Confirm DPIAs: high-risk or large-scale processing should have a documented impact assessment.
• Review processors and cross-border transfers: vendor contracts, transfer mechanisms and the safeguards each law requires.
• Assess breach readiness: detection, and whether you can meet the notification deadline to the regulator and to affected people.
• Check retention and minimisation: you keep only what you need, only as long as you need it.

Representative engagement: a US consumer app

A useful way to picture the work: a US consumer app collecting data from users across several states needed to know which privacy laws bit and where its biggest exposure sat. We mapped its data, tested its consumer-rights and opt-out flows (including Global Privacy Control handling), reviewed its vendors, and delivered one remediation plan ordered by regulatory and reputational risk. This example is representative of how we structure USA privacy audits; named client references are available under NDA on request. We are a cybersecurity and privacy assessor rather than a law firm, so for formal legal opinions we work alongside your data-protection counsel.

How long does a USA data privacy audit take, and what does it cost?

Most privacy audits run a few weeks end to end, depending on how many systems, vendors and data flows are in scope. Cost follows that scope rather than a fixed list price, so we run a short, free discovery call, agree the scope in writing, and give you a fixed quote before any work starts. If you are working to a regulator, customer or audit deadline, tell us the date and we will tell you honestly whether it is achievable.

Is there a single US federal privacy law?

No. The US runs a patchwork of state privacy laws (led by California’s CCPA/CPRA) plus sector rules like HIPAA and GLBA. We scope your audit to the states where you have customers and the sectors you operate in.

Does CCPA/CPRA apply to us if we are not in California?

It can — CCPA/CPRA turns on doing business with California residents and meeting certain thresholds, not on where you are based. We assess whether you fall in scope and where your gaps are, including honouring opt-out signals like Global Privacy Control.

How do we handle the different state breach-notification laws?

Every state has its own breach-notification statute with different triggers and timelines. We assess whether your incident process can identify the right obligations fast enough and build that into your playbook.

Do we need to honour opt-out preference signals?

Several state laws require recognising universal opt-out mechanisms such as Global Privacy Control. We test whether your site and systems actually do this — a common and visible gap.

How often should we run a privacy audit?

At least annually, and again after any major change — a new product, a new state market, a new vendor handling personal data, or a breach.