Law / United States / 
Nevada
Security measures for data collectors maintaining personal information
In force.
A security baseline statutes rule binding public and private bodies.
What it requires
- This binds any data collector, a term defined to include a governmental agency, institution of higher education, corporation, financial institution, retail operator, or other business entity or association, that maintains records containing the personal information of a Nevada resident.
- Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.NIST CSF 2.0PR.DS-01
- If you are a governmental agency, additionally comply, to the extent practicable, with the current version of the CIS Controls published by the Center for Internet Security or the corresponding National Institute of Standards and Technology standards, with respect to the collection, dissemination, and maintenance of those records.NIST CSF 2.0GV.OC-03
- Require, by contract, any person to whom you disclose a Nevada resident's personal information to implement and maintain the same reasonable security measures.NIST CSF 2.0GV.SC-05
- Compliance with a state or federal law that requires greater protection for the same records is deemed compliance with this section.
- Expect an elderly or disabled Nevada resident harmed by a violation of this section to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Via NRS 603A.260's deeming of a violation of NRS 603A.010 to 603A.290, inclusive (which includes this section), as a deceptive trade practice under NRS 598.0903 to 598.0999, a natural person, firm, or corporate officer or managing agent who knowingly and willfully engages in the deemed practice is guilty of a misdemeanor, or of a category D, C, or B felony where the offense involves a quantifiable loss of property or services, up to a category B felony at $100,000 or more, punishable by 1 to 20 years' imprisonment and a fine of up to $15,000.
Penalty structure
NRS 603A.260 deems a violation of NRS 603A.010 to 603A.290 a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999. The coded $25,000 is the highest tier: NRS 598.0973 lets the court or the Director impose a civil penalty of not more than $25,000 for each violation of a deceptive trade practice directed toward an elderly person, and NRS 598.09735 the same for one directed toward a minor person. The tiers beneath it are not more than $15,000 for each violation for a practice directed toward a person with a disability (NRS 598.0973), not more than $15,000 for each willful violation in an action by the Commissioner, the Director, a district attorney or the Attorney General (NRS 598.0999(2)), and not more than $10,000 for each violation of a court order or injunction (NRS 598.0999(1)). A civil penalty is not imposed where the Department of Motor Vehicles has fined the same act (NRS 598.0974).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
Nevada Attorney General, the Commissioner of the Consumer Affairs Unit, the Director of the Department of Business and Industry, or a county district attorney, via NRS 603A.260's deeming of a violation as a deceptive trade practice under NRS 598.0903 to 598.0999; also, for an elderly or disabled Nevada resident, an indirect private civil action under NRS 598.0977.
Settledness
- As of
- Open questions
- Does a data collector that is not a governmental agency meet 'reasonable security measures' in NRS 603A.210(1) by following the CIS Controls or National Institute of Standards and Technology standards that subsection 2 requires of a governmental agency?
- Does the deemed compliance in NRS 603A.210(4) apply to a data collector that meets only part of the state or federal law that 'requires a data collector to provide greater protection' to the same records?
What it reaches
Obligation class
Security
Applicability criteria
NRS 603A.030 defines a data collector as any governmental agency, institution of higher education, corporation, financial institution or retail operator or any other type of business entity or association that, for any purpose, handles, collects, disseminates or otherwise deals with nonpublic personal information. NRS 603A.100(1) takes information maintained or transmitted under NRS 439.581 to 439.597 out of the chapter.
- As of
- Combinator
- All of
- Criteria
- A data collector that maintains records which contain personal information of a resident of this State
What this law does
A data collector that maintains records containing the personal information of a Nevada resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
A data collector that is a governmental agency must, to the extent practicable, additionally comply with the current CIS Controls published by the Center for Internet Security or corresponding National Institute of Standards and Technology standards for the collection, dissemination, and maintenance of those records. A contract disclosing a Nevada resident's personal information must require the recipient to implement and maintain the same reasonable-security duty.
Compliance with a state or federal law requiring greater protection for the same records is deemed compliance with this section. The provisions this entry describes came into force on different days. Senate Bill 302 of 2019 (chapter 412, Statutes of Nevada 2019) added subsections 2 and 5. Section 1 of that act, which amended this section, became effective on .
The original security-measures duty, in section 23 of chapter 485, Statutes of Nevada 2005, took effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .