Nevada SB220 and ISO 27001: where the certification leaves the privacy obligation uncovered
Julian ThorneApril 29, 2026
Key takeaways
ISO 27001 certification does not satisfy Nevada SB220 obligations. The two frameworks address different legal requirements: ISO 27001 covers information security management; SB220 covers consumer opt-out rights for data sales. The control overlap is minimal and incidental.
Nevada SB220 requires website operators to honor consumer opt-out requests within 60 days of receipt. The opt-out right applies to the sale of covered information — name, address, email, phone, social security number, and contact identifiers — to third parties.
SB220 enforcement runs through the Nevada Attorney General, who can seek injunctive relief and civil penalties for continued non-compliance after a court order. There is no per-violation fine structure, but for businesses that monetize consumer data, an injunction against data sales is an operational impact.
The SB220 compliance evidence that regulators would examine — opt-out request logs, data sale relationship documentation, functional opt-out mechanism records — is not produced by an ISO 27001 audit program and requires a separate evidence collection process.
Nevada SB220's definition of 'sale' is narrower than CCPA's. Businesses with CCPA compliance programs cannot assume SB220 is covered without verifying that their data flow mapping and opt-out workflow satisfy Nevada's specific covered information definition and response timeline.
The organizational behavior that creates SB220 exposure is not a security failure — it is a data monetization practice that predates the opt-out obligation and was never reviewed against the statute when it took effect.
TL;DR
Nevada SB220 is a narrow statute with a specific obligation: give Nevada consumers a way to opt out of the sale of their covered information, and honor that request within 60 days. ISO 27001 is an information security management framework that does not address opt-out mechanics, data sale relationships, or consumer request workflows. Organizations that pursue ISO 27001 assuming it covers their Nevada privacy obligations are certifying their security posture and leaving the privacy statute unaddressed. The gap is structural and requires a separate compliance workstream, not an extension of the ISO 27001 program.
The certification that covered everything except the statute
A data analytics firm operating across multiple US states achieved ISO 27001 certification in 2023. Their ISMS covered asset management, access controls, incident response, and supplier relationships. Their security posture was strong. Their Statement of Applicability ran to 114 controls. Their lead auditor noted during the closing meeting that the organization's documentation practices were among the cleaner implementations he had reviewed that year. Nevada SB220 was not mentioned in the audit scope, the risk treatment plan, or the Statement of Applicability.
The firm's business model included licensing consumer contact data to marketing partners. Some of those consumers were Nevada residents. The licensing agreements met the statutory definition of a sale under SB220. The firm had no opt-out mechanism on its website, no process for receiving and honoring opt-out requests, and no documentation mapping which data flows constituted sales of covered information. The ISO 27001 certification was accurate. The SB220 gap was complete. The certification had not been designed to address it, and nothing in the audit process had surfaced the omission.
What SB220 requires and why ISO 27001 does not address it
Nevada SB220 imposes obligations on website operators — entities that operate websites or online services that collect covered information from Nevada consumers. If the operator sells that covered information to third parties, it must provide a designated request address (typically a web form or email address) through which consumers can opt out of the sale. Once a consumer submits an opt-out request, the operator has 60 days to honor it. The statute does not require a privacy policy in any particular format, does not create deletion rights, and does not mandate data processing disclosures beyond the opt-out mechanism. It is a narrowly scoped statute focused on one consumer right applied to one data practice.
Example
ISO 27001's Annex A controls address access control, cryptography, physical security, operations security, communications security, supplier relationships, and incident management. None of those control families addresses whether a business is selling consumer data to third parties, whether consumers have been given a mechanism to opt out of that sale, or whether opt-out requests are being processed within a regulatory timeline. The ISO 27001 risk assessment process could theoretically surface SB220 compliance as a regulatory risk requiring treatment — but only if the organization identifies SB220 applicability during the context of the organization analysis under Clause 4.1 and builds a corresponding risk treatment. In practice, Vulnox assessments of ISO 27001 certified organizations that operate in Nevada find that SB220 is rarely included in the regulatory context documentation.
The covered information definition under SB220 is specific: first and last name combined with address, email address, telephone number, social security number, or any other information that can be used to contact a specific individual. The definition is narrower than CCPA's personal information definition, which includes inferences and browsing data. A business that has mapped its data flows against CCPA may be mapping a broader category than SB220 requires — but the SB220-specific question of which data flows constitute a 'sale' to a 'third party' under Nevada's definitions requires a separate analysis, because the statutory definitions differ.
What assessments of Nevada-operating businesses show
Assessment base: Vulnox assessment data, 2024-2025, multi-state website operator and data analytics firm engagements
SB220 applicability not identified during ISO 27001 context analysis
In assessments of ISO 27001 certified organizations operating websites that serve Nevada consumers, Vulnox consistently finds that Nevada SB220 does not appear in the regulatory context documentation required by Clause 4.1. Organizations document GDPR applicability if they serve EU residents, HIPAA applicability if they handle health data, and CCPA applicability if they serve California consumers. Nevada SB220 is less widely known and less frequently enforced than those frameworks, and it does not appear in most standard compliance library templates. The result is that organizations with a rigorous ISO 27001 program and a Nevada consumer base have a regulatory gap that the program was never designed to address.
ISO 27001 Clause 4.1 requires that the organization determine external and internal issues relevant to its purpose, including legal and regulatory requirements. A Nevada-operating website that sells consumer data and has not included SB220 in its regulatory context has an ISMS scope gap — and a live statutory obligation that the certified program is not covering. The gap is not a security failure. It is a compliance scoping failure.
Opt-out mechanisms that satisfy CCPA requirements but not SB220 response timelines
Organizations with CCPA compliance programs frequently have a 'Do Not Sell or Share My Personal Information' link and a consumer request processing workflow. The CCPA and SB220 opt-out rights are conceptually similar, which leads organizations to assume that a CCPA-compliant opt-out mechanism satisfies SB220. The practical gap is in response timelines and covered information scope. CCPA requires response within 45 business days with a possible 45-day extension. SB220 requires response within 60 calendar days with no extension provision. An opt-out workflow built around CCPA timelines may satisfy CCPA and violate SB220 for the same request if the processing workflow runs past 60 calendar days.
Businesses that have invested in CCPA compliance infrastructure are not starting from zero on SB220. But the assumption that CCPA compliance equals SB220 compliance is incorrect, and the gap is in operational details — timeline, covered information scope, and whether the opt-out mechanism is specifically designated as required by Nevada's statute — rather than in the presence or absence of an opt-out program.
Data sale relationship documentation that does not map to SB220's covered information definition
In assessments of organizations that license or sell consumer data as part of their business model, Vulnox finds that data flow documentation is typically built around the data categories the business tracks internally — demographic data, behavioral data, transaction data — rather than around the covered information definition of any specific statute. When SB220 applicability is assessed, the question is whether any of those data flows include name combined with address, email, phone number, or social security number of Nevada residents, and whether the counterparty receiving the data qualifies as a third party under Nevada's definition. Organizations with data licensing operations frequently cannot answer that question from their existing documentation without a targeted mapping exercise.
The inability to determine SB220 applicability from existing documentation is itself a compliance gap. If an organization cannot identify which of its data sale relationships involve Nevada residents' covered information, it cannot determine whether the opt-out obligation applies or whether received opt-out requests are being honored for the correct data flows.
The privacy program that is more complete than SB220 requires and still violates it
Common belief
Organizations with GDPR-compliant privacy programs believe their privacy posture is strong enough to satisfy any US state privacy statute. GDPR is the most demanding privacy framework most organizations have implemented. If they can satisfy GDPR's data subject rights, consent requirements, and processing documentation obligations, they can certainly satisfy a narrower US state opt-out statute.
What we found
In assessments of GDPR-compliant organizations with Nevada consumer populations, Vulnox found that the data subject rights infrastructure was capable of receiving SB220 opt-out requests but was routing them through the GDPR deletion request workflow — which has a different response timeline, different documentation requirements, and different downstream data handling obligations. The Nevada consumer received a response confirming their GDPR deletion request had been processed. The SB220 opt-out obligation — not selling the data to third parties, which is different from deleting it — was not addressed by the deletion workflow.
GDPR compliance requires data subject rights infrastructure, consent management, data processing records, and data protection impact assessments. Nevada SB220 requires a designated opt-out address and a 60-day response process for opt-out requests from Nevada residents. The two frameworks share almost no implementation overlap. An organization with a GDPR-compliant consent management platform and a data subject rights portal has tools that are architecturally capable of supporting SB220 compliance — but only if those tools have been specifically configured to handle Nevada opt-out requests as a distinct request type, route them to the correct processing workflow, and confirm response within 60 calendar days. GDPR implementation does not automatically configure any of that.
What organizations say before the SB220 gap analysis
'We have a privacy policy that includes a Do Not Sell link. We're covered for Nevada SB220.'
Root cause:A 'Do Not Sell My Personal Information' link satisfies the opt-out mechanism requirement if it functions as a designated request address — a way for consumers to submit opt-out requests — and if those requests are honored within 60 days. The link's presence in a privacy policy does not confirm that the request processing workflow exists, that requests received are being logged and acted on, or that the response timeline is being met. Regulators examining SB220 compliance would look for the opt-out request log, not for the presence of the link. Organizations that have the link without the operational workflow behind it have addressed the visibility requirement and not the compliance obligation.
'We don't sell customer data. SB220 doesn't apply to us.'
Root cause:Nevada SB220's definition of sale is specific and includes exchanges of covered information for monetary consideration or other valuable consideration. Organizations that license consumer contact data to marketing partners, share consumer profiles with advertising networks in exchange for ad placement, or provide consumer data to analytics firms as part of service agreements may be conducting sales under SB220's definition without characterizing those transactions as data sales internally. The determination of whether a data sharing arrangement constitutes a sale under SB220 requires reviewing the transaction against the statute's definition — not relying on the internal characterization of the relationship.
'Our CCPA opt-out process covers all state privacy law opt-out requirements.'
Root cause:CCPA and SB220 share a conceptual similarity — both create consumer opt-out rights for data sales — but they differ in covered information scope, response timelines, and statutory definitions. A CCPA opt-out process built around California's personal information definition may include data categories that SB220 does not cover and may exclude processing timelines that SB220 requires. The most common operational gap is the response timeline: CCPA allows 45 business days plus a possible 45-day extension; SB220 requires 60 calendar days with no extension. A CCPA workflow that runs to the outer limit of the California timeline may violate Nevada's.
What Nevada SB220 compliance programs miss
Data sale relationships created through advertising technology
Organizations that run programmatic advertising through ad networks or demand-side platforms are frequently sharing consumer identifiers — email addresses, device IDs, behavioral data linked to identifiable consumers — with those platforms in exchange for ad placement. Whether that exchange constitutes a sale under SB220 depends on whether the data includes covered information and whether the consideration received is monetary or equivalent. Organizations that have not reviewed their advertising technology data flows against SB220's sale definition are carrying potential applicability that has never been assessed. The advertising team configures the platform. The compliance team does not see the data flows.
Opt-out request handling after a merger or acquisition
SB220 opt-out requests are specific to the data controller that received the request. When a business is acquired, the acquiring entity inherits the opt-out obligations alongside the consumer data. If the opt-out request log is not transferred and integrated into the acquiring entity's request processing workflow, consumers who opted out before the acquisition may find their data included in data sale relationships the acquiring entity establishes with new third parties. This is an operational gap that creates compliance exposure for the acquiring entity without any new data collection activity — the exposure comes from the inherited data and the unresolved opt-out requests that came with it.
Third-party processors that independently sell shared data
SB220 creates obligations for website operators that sell covered information. It does not directly regulate what a third-party recipient does with data after the sale — that is a separate enforcement question involving the third party as an independent operator. However, an operator that shares covered information with a third party who then resells it may face scrutiny about whether the original transfer was structured to circumvent the opt-out right. Organizations that share consumer data with data brokers or analytics firms under service agreements that do not restrict downstream resale are creating a chain of data sales that an opted-out consumer's request cannot reach.
Where Nevada SB220 enforcement develops
The Nevada Attorney General will bring at least one SB220 enforcement action against an organization that had a published opt-out mechanism but was not honoring requests within the 60-day statutory window, before Q4 2027.
SB220 enforcement to date has focused on organizations with no opt-out mechanism. As the statute matures and consumer awareness of opt-out rights increases, the enforcement focus will shift to organizations that have the mechanism but are not operating it correctly. The 60-day response window is the most operationally demanding part of the statute and the most likely to be violated by organizations that built opt-out infrastructure for CCPA and assumed the Nevada timeline was satisfied. A test opt-out request submitted to the AG's office — a standard enforcement technique — would surface timeline violations without requiring a consumer complaint.
Confidence: mediumA published Nevada AG enforcement action citing Section 603A.345 violation where the business had a functional opt-out mechanism but failed to honor requests within 60 days, before Q4 2027.Nevada will amend SB220 to expand the covered information definition and add consumer rights beyond opt-out — moving toward a CCPA-comparable framework — within the next two legislative sessions, following the pattern of other states that began with narrow opt-out statutes and subsequently expanded them.
Nevada SB220 is one of the earliest US state privacy statutes. The states that followed Nevada — California, Colorado, Connecticut, Virginia, and others — enacted broader frameworks that include deletion rights, access rights, and correction rights. Nevada has observed the evolution of state privacy law since SB220 passed in 2019. The political and consumer advocacy pressure to expand the statute follows the pattern visible in other early-adopter states. Organizations that build SB220 compliance infrastructure around the current narrow opt-out obligation will need to extend that infrastructure if the legislature expands the framework.
Confidence: mediumA Nevada legislative amendment to Chapter 603A expanding covered information definition or adding consumer rights beyond opt-out, passed before the end of the 2027 legislative session.
The ISO 27001 audit scope problem is a scoping decision, not an auditor failure
ISO 27001 audits do not address Nevada SB220 compliance because ISO 27001 audits are not designed to address privacy statutes. The framework is explicitly scoped to information security management. Expecting an ISO 27001 certification to cover a consumer opt-out statute is a category error — it is asking a security framework to validate a privacy compliance obligation. The problem is not that ISO 27001 auditors miss SB220 during surveillance audits. The problem is that organizations use ISO 27001 certification as a proxy for overall compliance readiness when it is scoped to one domain of one compliance obligation. Privacy compliance requires a separate workstream with a separate evidence collection process, a separate regulatory context analysis, and a separate control mapping exercise. Organizations that build one compliance program and expect it to satisfy multiple regulatory frameworks end up with one certified program and multiple uncovered obligations.
Counterargument
The counterargument is that ISO 27001's Clause 4.1 requirement — determine external and internal issues relevant to the organization — is broad enough to encompass regulatory context including privacy statutes, and that a rigorous ISO 27001 implementation would surface SB220 applicability during the context analysis. That is technically correct. It is also true that most ISO 27001 implementations, including those that pass third-party certification audits, do not perform a sufficiently granular regulatory inventory to surface less-known state statutes like SB220. The standard allows for rigorous regulatory context analysis. It does not require one in terms specific enough to catch Nevada SB220 unless the organization already knows to look for it.
One thing to do this week
If your organization operates a website that collects information from Nevada residents and you have any data licensing, advertising network, or data sharing arrangements with third parties, pull those agreements and review them against SB220's definition of sale under NRS 603A.320. For each arrangement that qualifies, verify that your opt-out mechanism is accessible on your website, that there is a process for receiving and logging opt-out requests, and that the processing workflow can honor requests within 60 calendar days. If you cannot answer those three questions from existing documentation, you have a gap that the ISO 27001 program is not going to surface on its own.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
mapping digital footprintGDPR Compliance Guidelines
comprehensive GDPR complianceNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideUnderstanding Compliance Gap Analysis
compliance gap analysis guide
Frequently Asked Questions
What does Nevada SB220 actually require from website operators?
Nevada SB220 requires website operators that collect covered information from Nevada consumers and sell it to third parties to provide a designated opt-out mechanism — typically a visible link or form — and to honor opt-out requests within 60 days. Covered information includes name, address, email, phone number, social security number, and identifiers that can be used to contact a consumer. The obligation runs to any operator serving Nevada residents online regardless of where the business is physically located. The enforcement mechanism is Nevada Attorney General action for injunctive relief, with civil penalties for continued non-compliance after a court order.
Which ISO 27001 controls address Nevada SB220 obligations?
Almost none of them, directly. ISO 27001 is an information security management framework focused on confidentiality, integrity, and availability of information assets. SB220 is a consumer privacy statute focused on opt-out rights for data sales. The closest overlaps are data classification controls that help identify what constitutes covered information, and access controls that support the ability to honor deletion or restriction requests. ISO 27001 certification does not establish an opt-out mechanism, does not map data sale relationships to third parties, and does not create a consumer request response workflow. Organizations that assume certification satisfies SB220 have a structural gap between the two obligations.
How does Nevada SB220 differ from CCPA in practical compliance terms?
SB220 is narrower than CCPA in scope but creates obligations that CCPA compliance programs do not automatically satisfy. SB220 focuses specifically on the right to opt out of the sale of covered information by website operators — it does not create a right to deletion, a right to access, or a right to correct, which CCPA does. SB220's definition of 'sale' is also narrower than CCPA's, which matters for determining which data flows trigger the opt-out obligation. A business with a mature CCPA compliance program has the technical infrastructure for opt-out processing but may not have mapped its data flows against SB220's specific covered information definition or confirmed that its opt-out mechanism satisfies Nevada's response timeline requirements.
What evidence does Nevada SB220 compliance require that ISO 27001 audits do not examine?
SB220 compliance requires documentation that ISO 27001 audits do not address: a record of consumer opt-out requests received and the dates on which they were honored, evidence that the opt-out mechanism is accessible and functional on the website, documentation mapping which third-party data sale relationships are in scope, and records confirming that opted-out consumer data was not sold after the request was received. None of those evidence categories appear in ISO 27001 audit scope. An ISO 27001 certified organization that cannot produce opt-out request logs and data sale relationship documentation has a compliance gap that the certification does not cover.
What is the penalty for Nevada SB220 non-compliance?
The Nevada Attorney General can seek injunctive relief requiring the business to comply. If the business does not comply after a court order, civil penalties apply. The statute does not establish a per-violation fine structure like some other state privacy laws. The practical enforcement risk is not primarily monetary — it is that an AG investigation generates regulatory attention, potential reputational exposure, and legal costs that can exceed the cost of implementing the compliance obligation in the first place. For businesses that monetize consumer data as a revenue stream, an injunction against data sales is a direct operational impact.
How should a business approach a Nevada SB220 gap analysis if it already has ISO 27001 certification?
Start by treating SB220 as a separate compliance obligation from the ISO 27001 program rather than mapping SB220 controls onto ISO 27001 clauses. The gap analysis needs to answer three questions the ISO 27001 audit does not address: what covered information is collected from Nevada residents, which third-party relationships constitute a sale under SB220, and whether the opt-out mechanism and response workflow meet the statute's 60-day requirement. The ISO 27001 documentation — data asset inventory, vendor management records, access control configuration — provides useful source material for answering those questions, but the gap analysis output is a privacy compliance assessment, not an ISMS control review.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.