The SECURE Data Act 2026 and GUARD Financial Data Act were introduced on April 22, 2026. This legislation would impose major data restrictions and requirements across the U.S. economy. The bill would give the U.S. Department of Commerce and the Federal Trade Commission (FTC) expanded powers to oversee data collection and use.
The SECURE Data Act proposes comprehensive federal privacy legislation based upon five broad themes:
Data Minimization: Requires controllers (nonfinancial firms that control consumer data) and financial institutions to limit the collection of a consumer’s data to only what is necessary;
Data Access Rights: Consumers will have the right to request access to and obtain a copy of their data that is possessed by a controller or financial institution in a format that allows consumers the ability to transfer their data to another controller or financial institution;
Data Deletion Rights: Consumers will have the right to request deletion of their data that is possessed by a controller or financial institution;
Sensitive Data: Controllers and financial institutions will be required to obtain an opt-in by a consumer before taking any actions with the consumer’s sensitive data; and
National Standards: Both bills would establish national standards for the protection of Americans’ personal data, ending the confusing patchwork of state laws currently in place. The bills integrate rights, requirements, and definitions from state comprehensive laws and retain a role for the Federal Trade Commission, State Attorneys General, and insurance regulators.
The SECURE Data Act does not include a private right of action which has been a point of contention in previous privacy bills. The bill generally follows the Washington state and Virginia models.
The SECURE Data Act would adopt the state model for thresholds of applicability based on number of consumers. Any company that processes the data of more than 200,000 U.S. consumers would be subject to the provisions of the law. However, small businesses with less than $25 million in adjusted gross annual revenue would be exempt.
The bill would require data brokers to register in a database and includes a provision that would permit consumers to obtain a copy of their personal data in a format that is both portable and usable.
Additionally, the bill would provide consumers with the right to opt-out from sales, targeted advertising, and reliance on profiling to make a decision that has legal or similarly significant effect on the consumer.
Personal data about teens under the age of 16 would be treated as sensitive data under the draft bill. Sensitive data processing would require opt-in consent, and parents would be required to provide verified parental consent for this age group, expanding the Children’s Online Privacy Act requirement by three additional years of age.
The bill would enshrine in statute the long-held role of the Secretary of Commerce as an advisor and representative of the U.S. federal government on “international data flows and the protection of personal data in international commerce.” The bill would codify the longstanding policy position of the U.S. in favor of facilitating the “flow of data for commercial purposes” in a manner that protects personal data in international commerce.
The Secretary of Commerce would also be granted new powers to recognize codes of conduct that encourage privacy best practices among specific sectors or groups of companies.
Companies that conform to codes of conduct under the oversight of independent organizations would receive a rebuttable presumption of compliance with the SECURE Data Act.
Next Steps
The House Subcommittee for Commerce, Manufacturing, and Trade will soon schedule a legislative hearing, where members and witnesses will have a chance to share their opinions publicly. This will be followed by a subcommittee markup where members will introduce amendments, a step that will later be repeated at the full committee level.
Contact the authors of this advisory, or your DLA Piper engagement partner, if you have any questions.
Additional Information
Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act)
Business Associations Welcome Federal Data Privacy Legislation | U.S. Chamber of Commerce