Florida

Obligations

Business Obligations

• AppealsRequiredInternal appeal process for denied rights requests.
• Data securityRequiredMaintain reasonable administrative, technical, and physical safeguards as required by the statute.
• Privacy noticeRequiredProvide required privacy disclosures/notices.
• Sensitive dataState-specificConsent is required for covered sensitive-data processing; Florida also provides specific opt-out rights and special protections.
• Data minimizationRequired / state-specificLimit or govern collection/use consistent with the statute's duties and disclosed purposes.
• Universal opt outNot requiredNo general universal opt-out mechanism requirement in the current omnibus law.
• Processor contractsRequiredUse contracts governing processors/service providers as required.
• Consumer request processRequiredProvide methods for consumers to exercise statutory rights.
• Data protection assessmentRequiredConduct assessments for specified higher-risk processing.

Classification nuance: IAPP's current comprehensive-law tracker excludes Florida because of its unusually narrow business coverage. Digital Data Rights tracks it separately as an enacted privacy statute with narrow scope.

Exemptions

Common Exemptions

Exemptions are state-specific and may apply at the entity level, data level, or both. Verify the official statute before relying on an exemption. Treatment commonly varies for government, regulated financial/health information, higher education, nonprofits, employment data, and B2B data.

This list is not exhaustive.