SECURE Data Act

• Consumers: Grants access, correction, deletion, portability, and opt-out rights. Controllers must respond to requests within 45 days and may grant one 45-day extension, with two free requests per right per consumer each year.
• Businesses: Covers entities that process personal data for more than 200,000 consumers and have $25.0 million or more in annual revenue, or that process 100,000 consumers and derive 25% or more of revenue from selling personal data.
• Data brokers and processors: Data brokers must register annually and appear in a central searchable registry. Processors must follow controller instructions, meet contractual security duties, and remain liable despite subcontracting.

This bill also requires data minimization, mandatory disclosures for targeted ads and sales, limits re-identification of deidentified data, lets approved codes of conduct create a rebuttable presumption of compliance, directs a federal official to coordinate cross-border data flow policy, and gives the Federal Trade Commission enforcement authority with a 45-day right-to-cure notice before actions.