The California Consumer Privacy Act went into effect, but it is likely just the beginning of more privacy regulations. Privacy laws are popping up in many states and the federal government is working on national legislation. While the privacy laws impact everyone, commercial property owners are no exception, particularly those with privacy policies and those that integrate data-collection technology into their properties.

"California is certainly the biggest, but we have seen conversations from other states that are in very stages of considering privacy laws as well," Lisa Stanley, CEO of OSCRE, tells GlobeSt.com. "It points out to me that organizations need to have an effective approach to data governance at the top of the house, involving the C-suite and business leaders at every level of the organization to really examine what information they are collecting and if they need to collect that information."

There is also movement to adopt a privacy policy at the federal level as well. "Every day there is something new happening. Right now, you have each state passing laws that have some similarities but at the same time are different," Alison Bird, managing director at CohnReznick, tells GlobeSt.com. "It is really challenging on the commercial side to comply with this hodgepodge. There has been pressure to come up with a federal bill, but recently a democratic bill was backed by several key committee members. Republicans have now come out with their own version of the law, and they are meeting to begin the process. So, it looks like there is really interest in creating a federal law."

While both sides have created drafts, there are some major friction points. "The major friction points between the two sides, and the biggest is whether there is going to be preemption or not: will a state be able to pass a stricter law," says Bird. "The democratic law would allow for that, and the republican law would. If you don't have preemption, then the federal law is really setting a floor, the least amount of protection that each consumer should have. With preemption, the federal law would be the ceiling, and that would make compliance easier."

As these regulations get stricter, Stanley recommends having a privacy policy throughout every segment of the business. "There also needs to be an acknowledgement that there is inherently a higher and broader level of risk in organizations than there was previously with privacy being a component of cyber security," she says. "This includes looking at insurance issues and current liability policies. It is a more complex environment that we have seen in the past. These are challenges that are not going to get easier as we move forward."