Personal data faces constant security and privacy threats—a truth which results in massive risks for consumers and U.S. security overall, while creating a compliance nightmare for industry. An evolving patchwork of state, sectoral and international laws attempt to address data security and privacy, but without a comprehensive framework in the United States, privacy and security issues will linger. Though the United States lacks a federal data security and private law, there is increased interest in passing one. The R Street Institute’s Cybersecurity Program prioritizes research into the current status of federal data privacy and security legislation; the ways to address roadblocks and find consensus; and the increasing urgency for the United States to act.