Law / United States / 
Pennsylvania
House Bill 78, Consumer Data Privacy Act, general applicability and controller and processor duties
Pa. H.B. 78, secs. 2, 5, 6, 7 (PN 3688)
Before the second chamber, dated , as of .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
Where it has got to
The text described here is Printer's Number 3688, as amended by the Senate Communications and Technology Committee. That print is PN 3688, published .
Locally, this stage is second consideration in the Senate.
The stage above is recorded at www.palegis.us.
House passed HB 78 (PN 1476) 127-76 on . Senate Consumer Protection and Professional Licensure Committee reported it as committed 14-0 on and re-referred it to Communications and Technology same day; that committee re-reported it as amended (PN 3688) 11-0 on . Senate gave it first consideration and second consideration , and laid it on the table and removed it from the table on ; no later action recorded. The 2025-2026 session runs through .
What it requires
- As amended by Printer's Number 3688, HB 78 applies to a for-profit business meeting a revenue or data-volume threshold and requires it to conduct data protection assessments before high-risk processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- When is a purpose 'compatible with' the disclosed purposes under section 5(a)(2) of House Bill 78 (Printer's No. 3688), so that a controller may process personal data for it without the consumer's consent, for example using data collected to provide a service to train a model?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Section 7 requires a controller to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer (the section 2 definition covers targeted advertising, the sale of personal data, certain profiling and the processing of sensitive data), weighing the benefits of the processing against the risks to the consumer's rights as mitigated by safeguards. The Attorney General may require a controller to disclose an assessment relevant to an investigation, and the controller must make it available; the assessment is confidential and exempt from the Right-to-Know Law. The duty applies to processing activities created or generated after July 1 of the year starting one year after the effective date. A processor must provide the information the controller needs to conduct and document the assessments (section 6(a)(3)), make available the information needed to show its compliance on the controller's reasonable request, and report on an assessment of its measures on request (section 6(b)(3) and (5)). Section 5 states no record. Outside the cited sections, section 3(c)(4) lets a controller deny an opt-out request it has a documented belief is fraudulent, section 3(c)(5) offers retaining a record of a deletion request as one route to compliance, and section 9(g) puts on the controller the burden of showing that processing qualifies for an exemption; none is read into this row. The text is Printer's No. 3688 of a bill that has not been enacted. A controller is a for-profit entity that does business in the Commonwealth and meets a revenue or data-volume threshold, and a consumer is an individual who is a resident of the Commonwealth.
- Kind
- Implicit
- As of
- Provision
- Pa. H.B. 78 (PN 3688), sec. 7(a) and (c) (data protection assessment, availability to the Attorney General)
- Trigger
- personal_data_processing
What this law does
House Bill 78, as amended by the Senate Communications and Technology Committee (Printer's No. 3688), would apply to a for-profit controller doing business in Pennsylvania that meets a revenue threshold of more than $10,000,000, or that alone or in combination buys, receives, sells, or shares for commercial purposes the personal information of at least 100,000 consumers, households, or devices (raised from 50,000 in the original bill), or that derives at least 50% of annual revenue from selling personal information.
Controllers must limit processing to purposes disclosed to the consumer and conduct data protection assessments for high-risk processing; processors act only on a controller's documented instructions. The bill establishes no lawful-basis regime distinct from this disclosed-purpose limitation; consent is required specifically for sensitive-data processing, not for processing generally.
The bill passed the House 127-76 on , had second consideration in the Senate on , and was laid on the table and removed from the table on , with no Senate third-consideration vote or gubernatorial action as of .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .