For non-sensitive information, customers must be allowed to opt out of use and sharing of that information at any time and with minimum effort Take reasonable measures to keep customers’ data secure Give customers timely notice of data breaches, and in the event of a larger breach, give notice to law enforcement officials.