---
title: "Check the steps taken to protect personal information the business holds"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-20-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Check the steps taken to protect personal information the business holds

> Against the Start with Security lessons, list whether the business collected information it did not need, who can reach the stored data, how passwords are set, whether service providers are required to use reasonable…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Against the Start with Security lessons, list whether the business collected information it did not need, who can reach the stored data, how passwords are set, whether service providers are required to use reasonable security, and how paper and devices are disposed of. |
| What the lawyer must review | The FTC Start with Security guide says sound security starts by assessing the sensitivity of the information, that a business should not collect sensitive information it does not need, and that once it has a legitimate need to hold the data it should take reasonable steps to keep it secure, including need-to-know access. It says service providers should implement reasonable security measures, and it points to FTC cases about clear-text storage, shared administrative keys, and disposal of prescriptions in dumpsters. The Data Breach Response guide tells a business that has had a breach to secure the physical areas, consult counsel on the federal and state laws that may apply, and avoid misleading statements about the breach. Neither page is a certification checklist that replaces the lawyer's judgement about whether the steps fit the data. |
| Written for | United States |
| Applies to | [Check the steps taken to protect personal information the client holds](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-the-steps-taken-to-protect-personal-information-the-client-holds.md) |

## Checking plan

- What the AI does: Against the Start with Security lessons, list whether the business collected information it did not need, who can reach the stored data, how passwords are set, whether service providers are required to use reasonable security, and how paper and devices are disposed of.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- For a financial institution, the Safeguards Rule can add a written program these two pages do not set out.
- Children's information collected online has the additional confidentiality, security, and integrity duty in 15 U.S.C. § 6502.

## Sources

- [Start with Security: A Guide for Business](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) (checked 2026-10-22)
- [Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*