Sen. Gillibrand reintroduces Data Protection Act to create U.S. Data Protection Agency

What happened

U.S. Senator Kirsten Gillibrand (D‑NY) has reintroduced the Data Protection Act, which would establish an independent federal Data Protection Agency. The bill aims to limit collection, use and sharing of personal data, oversee high‑risk data practices, and develop model privacy standards. EPIC and other consumer‑rights groups have endorsed the proposal.

Why it matters for trust and compliance

• Its status is introduced. It is not law yet. Track it, but do not treat it as an obligation.
• The bill would create a new federal agency to enforce privacy protections across the United States, marking a major step toward comprehensive data‑privacy regulation.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Revisit retention schedules and data minimisation for the data involved.
5. Map the security requirements to existing controls and close gaps.
6. Inventory AI or automated decision systems in scope and their assessments.
7. Review age assurance and protections for minors' data.