Vermont Artificial Intelligence and Consumer Data Act (AICDA) VERMONTAICDA-1: AI System Inventory and Risk Assessment

What else in your programme already covers this

This control maps to 53 controls across 48 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

HITECH Act · 2 controls

HITECH-Scope-ARRA-XIII-42USC-Ch156-Subtitles HITECH Act Statutory Scope, ARRA Title XIII Origin and 42 USC Chapter 156 Structure (Subtitles A through D)
HITECH-SubtitleA-ONC-HIT-Standards-EHR-MU-PI HITECH Subtitle A - ONC, HIT Standards Committee, EHR Certification, Meaningful Use / Promoting Interoperability

Nebraska Data Privacy Act · 2 controls

NDPA-1 Applicability, Scope, and Carve-Outs
NDPA-4 Sensitive Data Processing Consent and Childrens Protections

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
NG-NDPA-4 Data Subject Rights and Automated Decision-Making

Section 508 - ICT Accessibility (Revised) · 2 controls

502 Interoperability with Assistive Technology
707 Real-Time Text Functionality

Family Educational Rights and Privacy Act (FERPA) · 1 control

FERPA-Part99.10_11_12 Right to Inspect and Review (34 CFR 99.10, 99.11, 99.12)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.8 Records of processing activities (UAE PDPL Article 8)

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

ICELAND-Act90-Chap3-Transparency-DataSubjectRights-Access-Rectification-Erasure Iceland Act 90/2018 - Chapter III Transparency + Data Subject Rights (Articles 14-23) - Access + Rectification + Erasure + Portability + Object + Automated Decisions

India DPDP Act · 1 control

DPDP-DataPrincipalRights-Sec11to14-Access-Correction-Erasure-Grievance-Nominate-Withdraw DPDP Act Sections 11-14 + Data Principal Rights + Access + Correction + Erasure + Grievance Redressal + Right to Nominate + Withdraw Consent + Duties + Verification of Identity

Indiana Consumer Data Protection Act · 1 control

INCDPA-ConsumerRights-Access-Correction-Deletion-Portability-OptOut-TargetedAd-Sale-Profiling-Appeal-45Day Indiana CDPA Consumer Rights - Access + Correction + Deletion + Portability + Opt-Out of Targeted Advertising/Sale/Profiling + 45-Day Response + 45-Day Extension + Authorised Agent + Appeal Process

Indonesia PDP Law · 1 control

IDPdp-DataSubjectRights-Art5to15-Access-Correction-Erasure-Portability-Object-Withdraw-Automated Indonesia PDP Articles 5-15 + Data Subject Rights + Access + Correction + Erasure + Portability + Object + Withdraw Consent + Automated Decision-Making + Damages Claim + Identity Verification + Response 3 Days

Iowa Consumer Data Protection Act · 1 control

ICDPA-ConsumerRights-Access-Delete-Portability-OptOut-Sale-Appeal-90Day-NO-Right-To-Correction-Authorised-Agent Iowa CDPA Consumer Rights - Access + Delete + Portability + Opt-Out of Sale + 90-Day Response + Appeal + Authorised Agent + NO Right to Correction + NO Profiling Opt-Out + Free First Per Year

Jamaica Data Protection Act 2020 · 1 control

JM-DPA2020-Breach-Notification-Sec28-30-Duty-Notify-Commissioner-Affected-Subjects-72-Hours-Severe Jamaica DPA 2020 Personal Data Breach Notification + Sections 28-30 + Duty to Notify Commissioner + Affected Subjects + 72-Hour Reporting + High Risk + Severe + Mitigation + Documentation

Kentucky Consumer Data Protection Act · 1 control

KY-CDPA-Consumer-Rights-Section3-Access-Correction-Deletion-Portability-Object-Profiling-45-Days Kentucky CDPA Consumer Rights + Section 3 + Right of Access + Correction + Deletion + Portability + Right to Object to Sale/Targeted Advertising/Profiling + 45-Day Response Window + Single 45-Day Extension + Free for First Request

Kenya Data Protection Act · 1 control

KE-DPA-Data-Subject-Rights-Sections26-Access-Correction-Erasure-Object-Portability-Restriction-30-Days Kenya DPA Data Subject Rights + Section 26 + Right to be Informed + Access + Correction + Erasure + Object + Restriction + Portability + Automated Decision-Making + 30-Day Response + Free for First Request + Refusal Grounds Limited

LGPD · 1 control

LGPD-BR-Data-Subject-Rights-Article-18-Confirmation-Access-Correction-Anonymization-Portability-Revoke-Sharing Brazil LGPD Data Subject Rights + Article 18 + 9 Rights + Confirmation + Anonymization

Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018) · 1 control

LV-PDPL-Data-Subject-Rights-Access-Correction-Erasure-Restriction-Portability-Objection-Sec18-Sec38 Latvia PDPL Data Subject Rights + Access + Correction + Erasure + Portability + Section 18 + 38

Malaysia PDPA 2010 · 1 control

MY-PDPA-Security-Principle-Retention-Data-Integrity-Breach-Notification-72-Hour-Section-12B-2024-Amendment Malaysia PDPA Security + Retention + Data Integrity + Breach Notification 72 Hour + Section 12B + 2024 Amendment

Maryland Online Data Privacy Act of 2024 · 1 control

MD-MODPA-Consumer-Rights-Section-14-4603-Access-Correction-Deletion-Portability-Opt-Out-Appeal Maryland MODPA Consumer Rights + Section 14-4603 + Access + Correction + Deletion + Portability + Opt-Out + Appeal

Mauritius DPA · 1 control

MU-DPA-Data-Subject-Rights-Sections-26-33-Access-Rectification-Erasure-Restriction-Portability-Objection Mauritius DPA Subject Rights + Sections 26 to 33 + Access + Rectification + Erasure + Restriction + Portability + Objection

Mexico LFPDPPP · 1 control

MX-LFPDPPP-ARCO-Rights-Articles-22-25-Acceso-Rectificacion-Cancelacion-Oposicion-Reglamento-89-103 Mexico LFPDPPP ARCO Rights + Articles 22-25 + Acceso + Rectificacion + Cancelacion + Oposicion + Reglamento 89-103

Minnesota Consumer Data Privacy Act · 1 control

MN-CDPA-Consumer-Rights-Section-325O-04-Access-Correct-Delete-Portability-List-Third-Parties-Opt-Out-Appeal-AIQUEST-Profile Minnesota CDPA Consumer Rights + Section 325O.04 + Access + Correct + Delete + Portability + List of Third Parties + Opt-Out + Appeal + AI Question Profile

Montana Consumer Data Privacy Act · 1 control

MT-CDPA-Consumer-Rights-MCA-30-14-2807-Access-Correct-Delete-Portability-Opt-Out-Appeal-AG-Referral Montana CDPA Consumer Rights + MCA 30-14-2807 + Access + Correct + Delete + Portability + Opt-Out + Appeal + AG Referral

NIST Privacy Framework · 1 control

NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-122 · 1 control

NISTSP122-3 PII Data Subject Rights and Automated Decision-Making

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

NRFCS-4 Consumer Privacy Rights, Consent, Marketing, and Loyalty Data

New Hampshire Data Privacy Act · 1 control

NHPA-4 Sensitive Data, Children, and Minors 13-16 Opt-In Consent

New Jersey Data Privacy Act · 1 control

NJDPA-4 Sensitive Data, Children, and Adolescents 13-17 Opt-In

Nigeria Data Protection Regulation (NDPR) · 1 control

NGNDPR-4 Data Subject Rights and Automated Decision-Making

Oregon Consumer Privacy Act · 1 control

OREGONCPA-2 Consumer Rights: Access, Correction, Deletion, Portability, Opt-Out

PDPA Singapore · 1 control

PDPASG-3 Access, Correction, Data Portability, and Individual Rights

PDPA Thailand · 1 control

PDPATH-3 Data Subject Rights, Automated Decisions, Accuracy

POPIA · 1 control

POPIASA-3 Data Subject Rights (Access, Correction, Objection), Automated Decisions

Pakistan Personal Data Protection Bill 2023 · 1 control

PAKPDPB-3 Data Subject Rights

Personal Data Act (personopplysningsloven) · 1 control

NORWAY-2 Data Subject Rights and Automated Decision-Making

Peru DPL · 1 control

PERU-5 Security of Personal Data and Processor Agreements

Privacy Act 1988 (Australia) · 1 control

AUPRV-5 APP 12-13 Access and Correction of Personal Information

Privacy Act 2020 · 1 control

NZPRV-3 IPP 6-8 Access, Correction, Accuracy

Qatar DPL · 1 control

QATAR-3 Data Subject Rights

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

South Korea PIPA · 1 control

PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37

Taiwan PDPA · 1 control

TAIWAN-2 Consent, Notice, Sensitive Data

Texas Data Privacy Act · 1 control

TEXASTDPSA-1 Scope, Applicability, Exemptions

Turkey KVKK · 1 control

TURKEYKVKK-1 VERBIS Registration and Lawful Basis

UK GDPR (UK General Data Protection Regulation) · 1 control

UKGDPRREG-2 Data Subject Rights (Articles 12-22)

Uruguay DPL · 1 control

URUGUAY-2 Data Subject Rights (ARCO + Habeas Data)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.