---
title: "Check reasonable steps to protect personal information an organisation holds"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-QU20261022-14-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Check reasonable steps to protect personal information an organisation holds

> Make a short control list from the facts: what was collected, where it is stored, who has access, whether it is encrypted, what the service-provider contract requires, and how records are thrown away.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Make a short control list from the facts: what was collected, where it is stored, who has access, whether it is encrypted, what the service-provider contract requires, and how records are thrown away. Tie each gap to a lesson on the FTC page. |
| What the lawyer must review | The FTC Start with Security guide treats reasonable security as a set of choices matched to the business and the sensitivity of the information. Lessons on the page include not collecting data the business does not need, restricting access to a need-to-know basis, requiring secure passwords and authentication, requiring service providers to implement reasonable security measures, and disposing of paper and equipment that still contain personal information. The guide names Social Security numbers among the data exposed when those controls failed in the cases it describes. The Data Breach Response guide is the companion for what to do if the controls fail: secure the scene, call counsel, and notify under the state and federal rules that apply to the information. |
| Written for | United States |
| Applies to | [Check reasonable steps to protect personal information that is held](https://ailawframework.com/practice/privacy-data-protection-and-cyber/check-reasonable-steps-to-protect-personal-information-that-is-held.md) |

## Checking plan

- What the AI does: Make a short control list from the facts: what was collected, where it is stored, who has access, whether it is encrypted, what the service-provider contract requires, and how records are thrown away. Tie each gap to a lesson on the FTC page.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- This is FTC guidance drawn from enforcement, not a private right of action written out on these pages.
- State laws can require specific safeguards. These two pages do not catalogue them.

## Sources

- [Start with Security: A Guide for Business](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) (checked 2026-10-22)
- [Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*