In addition to organizations that don’t meet the revenue or volume thresholds, there are other exemptions for higher education institutions, nonprofit organizations, government organizations and contractors, indigenous tribes, air carriers, those covered by the Health Insurance Portability and Accountability Act (HIPAA), and financial institutions governed by the Gramm-Leach-Bliley Act.
In addition, information subject to other laws is exempt, such as HIPAA, the Gramm-Leach-Bliley Act, Fair Credit Reporting Act, Driver’s Privacy Protection Act, Family Educational Rights and Privacy Act, or Farm Credit Act.