{ "name": "State data breach notification laws", "description": "Consumer deadlines, regulator and attorney general notice, credit bureau thresholds and GLBA treatment for 54 jurisdictions, each linked to its statute.", "page": "https://risktemplate.com/reference/state-data-breach-notification-laws/", "csv": "https://risktemplate.com/reference/data/state-breach-notification-laws.csv", "creator": "RiskTemplates (risktemplate.com)", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)", "last_verified": "2026-09-30", "row_count": 54, "built_from": [ "scripts/templates/ir_states.json" ], "disclaimer": "Reference summary, not legal advice. Confirm obligations against the cited statute or rule and with counsel.", "rows": [ { "jurisdiction": "Alabama", "code": "AL", "citation": "Ala. Code § 8-38-1 et seq. (Data Breach Notification Act of 2018)", "citation_url": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "As expeditiously as possible, no later than 45 days after determining a breach reasonably likely to cause substantial harm (or receipt of third-party-agent notice)", "consumer_clock_start": "determination that the breach is reasonably likely to cause substantial harm", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes — if number of individuals notified exceeds 1,000", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "Within 45 days (same trigger as individual notice)", "regulator_timing_text": "Within 45 days (same trigger as individual notice)", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "Notify all nationwide CRAs without unreasonable delay if >1,000 individuals notified at a single time", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes — notice only if reasonably likely to cause substantial harm; written determination kept ≥5 years; no AG filing", "glba_deemed_compliance": "Yes — entity subject to federal breach-notice rules (incl. GLBA) exempt if it maintains procedures, notifies individuals, and timely sends AG a copy when >1,000", "special_notes": "Third-party agents must notify the covered entity within 10 days (8-38-8). Keep a written no-harm determination 5 years. Federally regulated entities following federal rules must still send the AG a copy when >1,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "consumer_deadline_text": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "regulator_required_text": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-6", "regulator_timing_text": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-6", "pi_definition_summary": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "breach_definition": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "exceptions": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "penalty_summary": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "substitute_notice": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "credit_bureau_text": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "risk_of_harm_text": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "glba_deemed_compliance": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5", "private_right_of_action": "https://alison.legislature.state.al.us/code-of-alabama?section=8-38-5" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Alaska", "code": "AK", "citation": "Alaska Stat. § 45.48.010 et seq.", "citation_url": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expeditious time possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General (only when relying on a no-harm determination)", "regulator_threshold_label": "Conditional (see rule)", "regulator_required": "conditional", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Only if entity relies on no-harm determination: written notice to AG required before skipping resident notice; no general AG notice requirement", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Written AG notice before skipping resident notice (no-harm determination)", "regulator_timing_text": "No deadline; AG written notice is a precondition of the no-harm determination", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 residents: notify all nationwide CRAs without unreasonable delay (GLBA-subject entities exempt from CRA notice)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes — requires written AG notification, written determination kept 5 years", "glba_deemed_compliance": "No general GLBA/federal exemption (GLBA exemption applies only to CRA notice)", "special_notes": "AG notice applies only when relying on a no-harm determination: notify the AG in writing before skipping resident notice and keep the determination 5 years.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "consumer_deadline_text": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "regulator_required_text": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "regulator_timing_text": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "pi_definition_summary": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "breach_definition": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "exceptions": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "penalty_summary": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "substitute_notice": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "credit_bureau_text": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "risk_of_harm_text": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "glba_deemed_compliance": "https://www.akleg.gov/basis/statutes.asp#45.48.010", "private_right_of_action": "https://www.akleg.gov/basis/statutes.asp#45.48.010" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Arizona", "code": "AZ", "citation": "Ariz. Rev. Stat. § 18-551 et seq.", "citation_url": "https://www.azleg.gov/ars/18/00552.htm", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Within 45 days after determination of breach", "consumer_clock_start": "determination of the breach", "regulator_recipients": "Attorney General + Director, Arizona Dept. of Homeland Security", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes — if >1,000 individuals: AG AND director of Arizona Dept. of Homeland Security (plus 3 largest CRAs)", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "Within 45 days after determination", "regulator_timing_text": "Within 45 days after determination", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 individuals: notify 3 largest nationwide CRAs within 45 days", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes — no notice if determined no substantial economic loss reasonably likely; no documentation/AG filing requirement stated", "glba_deemed_compliance": "Yes — GLBA-subject persons and HIPAA covered entities/BAs fully exempt; federal-regulator-procedure compliance deemed compliance", "special_notes": "Over 1,000: notify the AG, the Director of the Arizona Dept. of Homeland Security and the 3 largest CRAs within 45 days. GLBA-subject persons and HIPAA covered entities/business associates are fully exempt.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.azleg.gov/ars/18/00552.htm", "consumer_deadline_text": "https://www.azleg.gov/ars/18/00552.htm", "regulator_required_text": "https://www.azleg.gov/ars/18/00552.htm", "regulator_timing_text": "https://www.azleg.gov/ars/18/00552.htm", "pi_definition_summary": "https://www.azleg.gov/ars/18/00551.htm", "breach_definition": "https://www.azleg.gov/ars/18/00551.htm", "exceptions": "https://www.azleg.gov/ars/18/00552.htm", "penalty_summary": "https://www.azleg.gov/ars/18/00552.htm", "substitute_notice": "https://www.azleg.gov/ars/18/00552.htm", "credit_bureau_text": "https://www.azleg.gov/ars/18/00552.htm", "risk_of_harm_text": "https://www.azleg.gov/ars/18/00552.htm", "glba_deemed_compliance": "https://www.azleg.gov/ars/18/00552.htm", "private_right_of_action": "https://www.azleg.gov/ars/18/00552.htm" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Arkansas", "code": "AR", "citation": "Ark. Code Ann. § 4-110-101 et seq. (Personal Information Protection Act)", "citation_url": "https://arkleg.state.ar.us/Acts/FTPDocument?path=%2FACTS%2F2019R%2FPublic%2F&file=1030.pdf&ddBienniumSession=2019%2F2019R", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time and manner possible, without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes — only if breach affects >1,000 individuals", "regulator_timing": "earlier_of", "regulator_timing_group": "Fixed days or at consumer notice, whichever is first", "regulator_timing_short": "Same time as individual notice or within 45 days of determination, whichever is first", "regulator_timing_text": "At the same time individuals are notified or within 45 days after determining reasonable likelihood of harm, whichever occurs first", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None in statute", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes — written determination and supporting docs retained 5 years; send to AG within 30 days of written request", "glba_deemed_compliance": "Yes — deemed compliance if regulated by state/federal law with greater protection and at least as thorough breach rules", "special_notes": "AG (>1,000) at the same time as individuals or within 45 days of determination, whichever is first. Keep a no-harm determination 5 years; give it to the AG within 30 days of a written request.", "verify_with_counsel": "", "source_type": "official + mirror", "source_note": "Official: Act 1030 of 2019 on arkleg.state.ar.us; other sections via FindLaw code mirror.", "field_sources": { "citation": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-105/", "consumer_deadline_text": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-105/", "regulator_required_text": "https://arkleg.state.ar.us/Acts/FTPDocument?path=%2FACTS%2F2019R%2FPublic%2F&file=1030.pdf&ddBienniumSession=2019%2F2019R", "regulator_timing_text": "https://arkleg.state.ar.us/Acts/FTPDocument?path=%2FACTS%2F2019R%2FPublic%2F&file=1030.pdf&ddBienniumSession=2019%2F2019R", "pi_definition_summary": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-103/", "breach_definition": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-103/", "exceptions": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-106/", "penalty_summary": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-108/", "substitute_notice": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-105/", "credit_bureau_text": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-105/", "risk_of_harm_text": "https://arkleg.state.ar.us/Acts/FTPDocument?path=%2FACTS%2F2019R%2FPublic%2F&file=1030.pdf&ddBienniumSession=2019%2F2019R", "glba_deemed_compliance": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-106/", "private_right_of_action": "https://codes.findlaw.com/ar/title-4-business-and-commercial-law/ar-code-sect-4-110-108/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "California", "code": "CA", "citation": "Cal. Civ. Code § 1798.82 (and § 1798.84 remedies; CCPA § 1798.150)", "citation_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "Within 30 calendar days of discovery or notification of breach (delay allowed for law enforcement or to determine scope/restore integrity)", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "Attorney General (single sample copy, submitted electronically)", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes — if >500 CA residents notified from a single breach (single sample copy, submitted electronically)", "regulator_timing": "after_individual", "regulator_timing_group": "After consumer notice", "regulator_timing_short": "Within 15 calendar days after notifying consumers", "regulator_timing_text": "Within 15 calendar days of notifying affected consumers", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None (notice must list major CRA contacts if SSN/DL/CA ID exposed)", "risk_of_harm": "No", "risk_of_harm_text": "No — notice required on reasonable belief of acquisition; no harm threshold", "glba_deemed_compliance": "No GLBA exemption; HIPAA covered entities deemed compliant with notice-content rules only if HITECH § 13402(f) followed", "special_notes": "SB 446 (eff. 1/1/2026): 30 calendar days. AG sample copy within 15 calendar days after notifying consumers if >500. Notice must be titled \"Notice of Data Breach\" with the prescribed headings; if you were the source and SSN/ID numbers were exposed, offer identity theft prevention services free for at least 12 months.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "consumer_deadline_text": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "regulator_required_text": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "regulator_timing_text": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "pi_definition_summary": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "breach_definition": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "exceptions": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "penalty_summary": "https://cppa.ca.gov/regulations/cpi_adjustment.html", "substitute_notice": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "credit_bureau_text": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "risk_of_harm_text": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "glba_deemed_compliance": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82", "private_right_of_action": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.150" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Colorado", "code": "CO", "citation": "Colo. Rev. Stat. § 6-1-716", "citation_url": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible, no later than 30 days after determination of breach", "consumer_clock_start": "determination of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "500 or more residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">=", "regulator_required_text": "Yes — if reasonably believed to affect 500 or more CO residents", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "No later than 30 days after determination", "regulator_timing_text": "No later than 30 days after determination of breach", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 CO residents: notify nationwide CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes — no notice if misuse has not occurred and is not reasonably likely; no AG filing requirement", "glba_deemed_compliance": "Yes — regulated entities following regulator's breach procedures deemed compliant, but AG notice still required", "special_notes": "AG if 500 or more Colorado residents, within 30 days after determination; CRAs if >1,000.", "verify_with_counsel": "", "source_type": "mirror", "source_note": "Official Colorado code is LexisNexis-hosted; FindLaw code mirror used.", "field_sources": { "citation": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "consumer_deadline_text": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "regulator_required_text": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "regulator_timing_text": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "pi_definition_summary": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "breach_definition": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "exceptions": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "penalty_summary": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "substitute_notice": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "credit_bureau_text": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "risk_of_harm_text": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "glba_deemed_compliance": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/", "private_right_of_action": "https://codes.findlaw.com/co/title-6-consumer-and-commercial-affairs/co-rev-st-sect-6-1-716/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Connecticut", "code": "CT", "citation": "Conn. Gen. Stat. § 36a-701b", "citation_url": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "consumer_deadline": "60 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 60, "consumer_day_basis": "calendar", "consumer_deadline_text": "Without unreasonable delay, no later than 60 days after discovery", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - AG notice whenever resident notice is required (no numeric threshold)", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than notice to residents", "regulator_timing_text": "Not later than the time notice is provided to residents", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - after appropriate investigation; no documentation/AG filing requirement", "glba_deemed_compliance": "Yes - deemed compliant if follows primary/functional regulator procedures AND notifies AG no later than resident notice; HIPAA/HITECH similar", "special_notes": "Offer 24 months of free identity theft prevention services for SSN/TIN breaches.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "consumer_deadline_text": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "regulator_required_text": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "regulator_timing_text": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "pi_definition_summary": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "breach_definition": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "exceptions": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "penalty_summary": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "substitute_notice": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "credit_bureau_text": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "risk_of_harm_text": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "glba_deemed_compliance": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b", "private_right_of_action": "https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Delaware", "code": "DE", "citation": "6 Del. C. § 12B-101 et seq.", "citation_url": "https://delcode.delaware.gov/title6/c012b/index.html", "consumer_deadline": "60 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 60, "consumer_day_basis": "calendar", "consumer_deadline_text": "Without unreasonable delay, no later than 60 days after determination of breach", "consumer_clock_start": "determination of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes - if more than 500 DE residents", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than notice to residents", "regulator_timing_text": "No later than the time notice is provided to residents (within 60 days if late-identified residents/no substitute notice)", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - after appropriate investigation; no documentation/AG filing requirement", "glba_deemed_compliance": "Yes but narrow - HIPAA/GLBA regulated entity following regulator procedures deemed compliant only with 60-day timing (§12B-103(b) as amended by HB 381, eff 9/2/2026)", "special_notes": "HB 381 (85 Del. Laws c. 464, eff. 9/2/2026): HIPAA/GLBA regulated entities are deemed compliant only with the 60-day timing rule; AG notice and SSN credit monitoring still apply. 1 year of free credit monitoring if SSNs were breached.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://delcode.delaware.gov/title6/c012b/index.html", "consumer_deadline_text": "https://delcode.delaware.gov/title6/c012b/index.html", "regulator_required_text": "https://delcode.delaware.gov/title6/c012b/index.html", "regulator_timing_text": "https://delcode.delaware.gov/title6/c012b/index.html", "pi_definition_summary": "https://delcode.delaware.gov/title6/c012b/index.html", "breach_definition": "https://delcode.delaware.gov/title6/c012b/index.html", "exceptions": "https://delcode.delaware.gov/title6/c012b/index.html", "penalty_summary": "https://delcode.delaware.gov/title6/c012b/index.html", "substitute_notice": "https://delcode.delaware.gov/title6/c012b/index.html", "credit_bureau_text": "https://delcode.delaware.gov/title6/c012b/index.html", "risk_of_harm_text": "https://delcode.delaware.gov/title6/c012b/index.html", "glba_deemed_compliance": "https://legis.delaware.gov/BillDetail?LegislationId=143107", "private_right_of_action": "https://delcode.delaware.gov/title6/c012b/index.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "District of Columbia", "code": "DC", "citation": "D.C. Code § 28-3851 et seq.", "citation_url": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible, without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Office of the Attorney General", "regulator_threshold_label": "50 or more residents", "regulator_required": "threshold", "regulator_threshold": 50, "threshold_operator": ">=", "regulator_required_text": "Yes - if breach affects 50 or more DC residents (written notice to OAG)", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than notice to residents", "regulator_timing_text": "Most expedient manner possible, without unreasonable delay, and no later than when notice is provided to residents", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - requires reasonable investigation and consultation with OAG before concluding no likely harm", "glba_deemed_compliance": "Yes - GLBA Title V / HIPAA procedures deemed compliant, but OAG notice still required", "special_notes": "OAG if 50 or more DC residents, no later than resident notice. A no-harm conclusion requires a reasonable investigation and consultation with OAG. Credit bureau notice (>1,000) does not apply to a person required to notify credit bureaus under GLBA Title V (28-3852(c)).", "verify_with_counsel": "Verify with counsel: private right of action: CPPA private-action section (28-3905(k)) was not separately fetched.", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "consumer_deadline_text": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "regulator_required_text": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "regulator_timing_text": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "pi_definition_summary": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3851", "breach_definition": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3851", "exceptions": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3851", "penalty_summary": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3853", "substitute_notice": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3851", "credit_bureau_text": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "risk_of_harm_text": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3851", "glba_deemed_compliance": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3852", "private_right_of_action": "https://code.dccouncil.gov/us/dc/council/code/sections/28-3853" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Florida", "code": "FL", "citation": "Fla. Stat. § 501.171", "citation_url": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "Without unreasonable delay, no later than 30 days after determination of breach (+15 days if good cause given in writing to Dept. of Legal Affairs)", "consumer_clock_start": "determination of the breach", "regulator_recipients": "Dept. of Legal Affairs (Attorney General)", "regulator_threshold_label": "500 or more residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">=", "regulator_required_text": "Yes - Dept. of Legal Affairs (AG) if 500 or more FL individuals", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "No later than 30 days after determination (no extension)", "regulator_timing_text": "As expeditiously as practicable, no later than 30 days after determination of the breach or reason to believe a breach occurred; no extension (the 15-day good-cause extension in 501.171(3)(a) applies only to notice to individuals under subsection (4))", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 individuals at a single time", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - after investigation and consultation with law enforcement; written determination retained 5 yrs and provided to Dept within 30 days", "glba_deemed_compliance": "Yes - notice per primary/functional federal regulator rules deemed compliant if copy provided to Dept", "special_notes": "Dept. of Legal Affairs notice (500 or more): no later than 30 days after determination, with no extension. Consumer notice can be extended 15 days for good cause provided in writing to the Dept. within 30 days after determination. A no-harm determination must be kept 5 years and provided to the Dept. within 30 days.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "consumer_deadline_text": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "regulator_required_text": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "regulator_timing_text": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "pi_definition_summary": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "breach_definition": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "exceptions": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "penalty_summary": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "substitute_notice": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "credit_bureau_text": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "risk_of_harm_text": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "glba_deemed_compliance": "https://www.flsenate.gov/Laws/Statutes/2026/501.171", "private_right_of_action": "https://www.flsenate.gov/Laws/Statutes/2026/501.171" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Georgia", "code": "GA", "citation": "O.C.G.A. § 10-1-910 et seq.", "citation_url": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible, without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "None", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "More than 10,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 10000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 10,000 GA residents, without unreasonable delay", "risk_of_harm": "No", "risk_of_harm_text": "No", "glba_deemed_compliance": "None in statute", "special_notes": "Reviewer note: the notice duty applies to information brokers and government data collectors, not all businesses. CRAs if >10,000 Georgia residents.", "verify_with_counsel": "", "source_type": "mirror", "source_note": "Official Georgia code is LexisNexis-hosted; FindLaw code mirror used.", "field_sources": { "citation": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "consumer_deadline_text": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "regulator_required_text": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "regulator_timing_text": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "pi_definition_summary": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-911/", "breach_definition": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-911/", "exceptions": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-911/", "penalty_summary": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "substitute_notice": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-911/", "credit_bureau_text": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "risk_of_harm_text": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "glba_deemed_compliance": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/", "private_right_of_action": "https://codes.findlaw.com/ga/title-10-commerce-and-trade/ga-code-sect-10-1-912/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Hawaii", "code": "HI", "citation": "Haw. Rev. Stat. § 487N-1 et seq. (notice at § 487N-2)", "citation_url": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (consistent with law enforcement needs and scoping/restoring system)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Office of Consumer Protection (Dept. of Commerce and Consumer Affairs)", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes - Office of Consumer Protection (DCCA), not AG, only if notice given to more than 1,000 persons at one time", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Without unreasonable delay", "regulator_timing_text": "In writing, without unreasonable delay", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons at one time (with OCP notice)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - built into 'security breach' definition; no documentation requirement", "glba_deemed_compliance": "Yes - financial institutions subject to federal Interagency Guidance or 12 CFR 748; HIPAA entities", "special_notes": "Regulator is the Office of Consumer Protection (not the AG), only if >1,000 persons notified at one time.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "consumer_deadline_text": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "regulator_required_text": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "regulator_timing_text": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "pi_definition_summary": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0001.htm", "breach_definition": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0001.htm", "exceptions": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "penalty_summary": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0003.htm", "substitute_notice": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "credit_bureau_text": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "risk_of_harm_text": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0001.htm", "glba_deemed_compliance": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0002.htm", "private_right_of_action": "https://data.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0487N/HRS_0487N-0003.htm" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Idaho", "code": "ID", "citation": "Idaho Code §§ 28-51-104 to 28-51-107", "citation_url": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay (no fixed day count), after good-faith investigation finds misuse occurred or is reasonably likely", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No for private/commercial entities (AG notice optional). Public agencies only: notify AG, no numeric threshold", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice for private entities", "regulator_timing_text": "N/A for private entities; public agencies within 24 hours of discovery", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes: good-faith, prompt investigation; notify only if misuse occurred or reasonably likely. No documentation/AG filing requirement", "glba_deemed_compliance": "Yes: entity regulated by state/federal law following its primary/functional regulator breach procedures deemed compliant", "special_notes": "Private entities may notify the AG but are not required to (public agencies: within 24 hours).", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "consumer_deadline_text": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "regulator_required_text": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "regulator_timing_text": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "pi_definition_summary": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-104/", "breach_definition": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-104/", "exceptions": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-106/", "penalty_summary": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-107/", "substitute_notice": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-104/", "credit_bureau_text": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "risk_of_harm_text": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-105/", "glba_deemed_compliance": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-106/", "private_right_of_action": "https://legislature.idaho.gov/statutesrules/idstat/title28/t28ch51/sect28-51-107/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Illinois", "code": "IL", "citation": "815 ILCS 530/1 et seq. (Personal Information Protection Act)", "citation_url": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes if notice required to more than 500 Illinois residents from a single breach (530/10(e)); HIPAA entities: copy to AG within 5 business days of notifying HHS (530/50). State agencies: >250 residents", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than notice to consumers", "regulator_timing_text": "Most expedient time/without unreasonable delay, but no later than when consumers are notified; HIPAA entities within 5 business days of HHS notice", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None for private data collectors (state agencies: >1,000)", "risk_of_harm": "No", "risk_of_harm_text": "No risk-of-harm exception", "glba_deemed_compliance": "HIPAA deemed compliance only (530/50); no GLBA notice exemption", "special_notes": "HIPAA covered entities/business associates: copy the AG within 5 business days of notifying HHS.", "verify_with_counsel": "Verify with counsel: penalties: ICFA civil-penalty amounts were not verified.", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "consumer_deadline_text": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "regulator_required_text": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "regulator_timing_text": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "pi_definition_summary": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "breach_definition": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "exceptions": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "penalty_summary": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "substitute_notice": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "credit_bureau_text": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "risk_of_harm_text": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "glba_deemed_compliance": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67", "private_right_of_action": "https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Indiana", "code": "IN", "citation": "Ind. Code § 24-4.9-1-1 et seq.", "citation_url": "https://iga.in.gov/ic/2025/Title_24/Article_4.9.pdf", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Without unreasonable delay, but not more than 45 days after discovery of the breach", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes, whenever individual disclosure is required (no threshold)", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "Not more than 45 days after discovery", "regulator_timing_text": "Without unreasonable delay, but not more than 45 days after discovery", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 consumers: notify each nationwide CRA", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes: notice required if owner knows/should know acquisition resulted or could result in identity deception, identity theft, or fraud; no documentation requirement", "glba_deemed_compliance": "Yes: GLBA/HIPAA/FCRA/PATRIOT/DPPA compliance plan requiring notice without unreasonable delay; financial institutions complying with federal interagency guidance exempt", "special_notes": "The 45-day cap applies to the AG notice as well as individual notice (HEA 1351, eff. 7/1/2022).", "verify_with_counsel": "", "source_type": "mirror", "source_note": "Official: Indiana Code 2025 Article 4.9 PDF on iga.in.gov; some fields were checked via a code mirror.", "field_sources": { "citation": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "consumer_deadline_text": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-3-3.html", "regulator_required_text": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-3-1.html", "regulator_timing_text": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-3-3.html", "pi_definition_summary": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-2-10.html", "breach_definition": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "exceptions": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "penalty_summary": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "substitute_notice": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "credit_bureau_text": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-3-1.html", "risk_of_harm_text": "https://codes.findlaw.com/in/title-24-trade-regulation/in-code-sect-24-4-9-3-1.html", "glba_deemed_compliance": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf", "private_right_of_action": "https://www.amp.legal/pdf/Indiana_Breach_Law.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Iowa", "code": "IA", "citation": "Iowa Code §§ 715C.1-715C.2", "citation_url": "https://www.legis.iowa.gov/docs/code/715C.pdf", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expeditious manner possible and without unreasonable delay (no fixed day count)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Director, AG Consumer Protection Division", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes if notice required to more than 500 Iowa residents (to director of AG Consumer Protection Division, written)", "regulator_timing": "after_individual", "regulator_timing_group": "After consumer notice", "regulator_timing_short": "Within 5 business days after consumer notice", "regulator_timing_text": "Within 5 business days after giving notice to any consumer", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes: no notice if no reasonable likelihood of financial harm after investigation/consultation with law enforcement; must be documented in writing and retained 5 years", "glba_deemed_compliance": "Yes: GLBA Title V compliant entities, HIPAA/HITECH compliant, and those following primary/functional federal regulator procedures are exempt", "special_notes": "Written notice to the director of the AG Consumer Protection Division within 5 business days after notifying consumers (>500).", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.legis.iowa.gov/docs/code/715C.pdf", "consumer_deadline_text": "https://www.legis.iowa.gov/docs/code/715C.pdf", "regulator_required_text": "https://www.legis.iowa.gov/docs/code/715C.pdf", "regulator_timing_text": "https://www.legis.iowa.gov/docs/code/715C.pdf", "pi_definition_summary": "https://www.legis.iowa.gov/docs/code/715C.pdf", "breach_definition": "https://www.legis.iowa.gov/docs/code/715C.pdf", "exceptions": "https://www.legis.iowa.gov/docs/code/715C.pdf", "penalty_summary": "https://www.legis.iowa.gov/docs/code/714.16.pdf", "substitute_notice": "https://www.legis.iowa.gov/docs/code/715C.pdf", "credit_bureau_text": "https://www.legis.iowa.gov/docs/code/715C.pdf", "risk_of_harm_text": "https://www.legis.iowa.gov/docs/code/715C.pdf", "glba_deemed_compliance": "https://www.legis.iowa.gov/docs/code/715C.pdf", "private_right_of_action": "https://www.legis.iowa.gov/docs/code/715C.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Kansas", "code": "KS", "citation": "K.S.A. 50-7a01 to 50-7a02", "citation_url": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No AG notice required for private entities", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 consumers at one time: notify nationwide CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes: good-faith investigation; notice only if misuse occurred or is reasonably likely; no documentation requirement", "glba_deemed_compliance": "Yes: entities regulated by state/federal law following primary/functional regulator breach procedures deemed compliant", "special_notes": "Insurers: the Insurance Commissioner has sole enforcement authority.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "consumer_deadline_text": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "regulator_required_text": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "regulator_timing_text": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "pi_definition_summary": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html", "breach_definition": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html", "exceptions": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "penalty_summary": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "substitute_notice": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0001.html", "credit_bureau_text": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "risk_of_harm_text": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "glba_deemed_compliance": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html", "private_right_of_action": "https://www.ksrevisor.gov/statutes/chapters/ch50/050_007a_0002.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Kentucky", "code": "KY", "citation": "KRS 365.732", "citation_url": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay (no fixed day count)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No AG notice required for private entities", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons at one time: notify nationwide CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes (in breach definition): must actually cause or reasonably be believed to cause identity theft or fraud; no documentation requirement", "glba_deemed_compliance": "Yes: statute does not apply to persons subject to GLBA Title V or HIPAA (no compliance condition)", "special_notes": "Persons subject to GLBA Title V or HIPAA are fully exempt.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "consumer_deadline_text": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "regulator_required_text": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "regulator_timing_text": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "pi_definition_summary": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "breach_definition": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "exceptions": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "penalty_summary": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "substitute_notice": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "credit_bureau_text": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "risk_of_harm_text": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "glba_deemed_compliance": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326", "private_right_of_action": "https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Louisiana", "code": "LA", "citation": "La. R.S. 51:3071-3077; AG notice rule at La. Admin. Code tit. 16, Pt. III, §701", "citation_url": "https://legis.la.gov/Legis/Law.aspx?d=322030", "consumer_deadline": "60 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 60, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible, no later than 60 days from discovery (law-enforcement delay allowed; AG may grant extension on written request)", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "AG Consumer Protection Section", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - written notice to AG Consumer Protection Section whenever resident notice is required under 51:3074; NO 500-resident threshold; must include names of all affected LA residents", "regulator_timing": "after_individual", "regulator_timing_group": "After consumer notice", "regulator_timing_short": "Received within 10 days after consumer notice", "regulator_timing_text": "Timely only if received within 10 days of distribution of notice to LA residents", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None - no CRA notice requirement", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no notice if reasonable investigation finds no reasonable likelihood of harm; written determination retained 5 years; provide to AG within 30 days of written request", "glba_deemed_compliance": "Yes - financial institutions complying with Federal Interagency Guidance on Response Programs (Mar. 7, 2005, as revised) deemed compliant", "special_notes": "AG notice for every notifiable breach (no 500 threshold) must include the names of all affected Louisiana residents and is timely only if received within 10 days after consumer notice; each late day can be a separate violation (up to $5,000).", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://legis.la.gov/Legis/Law.aspx?d=322030", "consumer_deadline_text": "https://legis.la.gov/Legis/Law.aspx?d=322030", "regulator_required_text": "https://www.law.cornell.edu/regulations/louisiana/La-Admin-Code-tit-16-SS-III-701", "regulator_timing_text": "https://www.law.cornell.edu/regulations/louisiana/La-Admin-Code-tit-16-SS-III-701", "pi_definition_summary": "https://legis.la.gov/Legis/Law.aspx?d=322029", "breach_definition": "https://legis.la.gov/Legis/Law.aspx?d=322029", "exceptions": "https://legis.la.gov/Legis/Law.aspx?d=322030", "penalty_summary": "https://legis.la.gov/Legis/Law.aspx?d=322030", "substitute_notice": "https://legis.la.gov/Legis/Law.aspx?d=322030", "credit_bureau_text": "https://legis.la.gov/Legis/Law.aspx?d=322030", "risk_of_harm_text": "https://legis.la.gov/Legis/Law.aspx?d=322030", "glba_deemed_compliance": "https://legis.la.gov/Legis/Law.aspx?d=322032", "private_right_of_action": "https://legis.la.gov/Legis/Law.aspx?d=322031" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Maine", "code": "ME", "citation": "10 M.R.S. § 1346 et seq. (Notice of Risk to Personal Data Act); breach provisions §§1347-1349", "citation_url": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "As expediently as possible, no more than 30 days after becoming aware of breach and identifying its scope (law-enforcement delay: within 7 business days after LE clears)", "consumer_clock_start": "becoming aware of the breach and identifying its scope", "regulator_recipients": "Attorney General (or DPFR regulator if DPFR-regulated)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - whenever resident notice is required: notify appropriate state regulator within Dept. of Professional & Financial Regulation, or AG if not DPFR-regulated", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "No statutory deadline (aligning with the 30-day consumer notice is prudent)", "regulator_timing_text": "No separate statutory deadline stated (§1348(5)); aligning with 30-day resident deadline is prudent practice", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 persons at a single time - notify nationwide CRAs without unreasonable delay (date of breach, estimated number, notice date)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes for non-information-brokers: notice only if misuse occurred or reasonably possible after good-faith investigation; information brokers must notify on acquisition. No documentation/AG filing requirement", "glba_deemed_compliance": "No GLBA-specific exemption; compliance with federal or state breach rules at least as protective as §1348 deemed compliance", "special_notes": "DPFR-regulated entities notify their DPFR regulator instead of the AG. Statute sets no regulator deadline.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "consumer_deadline_text": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "regulator_required_text": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "regulator_timing_text": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "pi_definition_summary": "https://legislature.maine.gov/statutes/10/title10sec1347.html", "breach_definition": "https://legislature.maine.gov/statutes/10/title10sec1347.html", "exceptions": "https://legislature.maine.gov/statutes/10/title10sec1349.html", "penalty_summary": "https://legislature.maine.gov/statutes/10/title10sec1349.html", "substitute_notice": "https://legislature.maine.gov/statutes/10/title10sec1347.html", "credit_bureau_text": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "risk_of_harm_text": "https://legislature.maine.gov/statutes/10/title10sec1348.html", "glba_deemed_compliance": "https://legislature.maine.gov/statutes/10/title10sec1349.html", "private_right_of_action": "https://legislature.maine.gov/statutes/10/title10sec1349.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Maryland", "code": "MD", "citation": "Md. Code Ann., Com. Law §§ 14-3501 to 14-3508", "citation_url": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "As soon as reasonably practicable, not later than 45 days after business discovers or is notified of breach", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - every breach requiring individual notice (no threshold); notice must include # of MD residents, description, steps taken, and sample notice", "regulator_timing": "before", "regulator_timing_group": "Before consumer notice", "regulator_timing_short": "BEFORE notice to individuals", "regulator_timing_text": "PRIOR to giving notice to individuals", "credit_bureau_label": "1,000 or more", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">=", "credit_bureau_text": "1,000 or more individuals - notify nationwide CRAs without unreasonable delay of timing, distribution, content", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - good-faith investigation; no notice if no likelihood of misuse; retain written records of determination 3 years", "glba_deemed_compliance": "Yes - businesses/affiliates subject to and complying with GLBA 501(b), FACTA 216, Interagency Guidelines & Response Guidance, or HIPAA, or their primary/functional regulator's rules, deemed compliant", "special_notes": "AG notice must be given BEFORE individual notice and include the number of Maryland residents, a description, steps taken and a sample notice.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "consumer_deadline_text": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "regulator_required_text": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "regulator_timing_text": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "pi_definition_summary": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3501&enactments=false", "breach_definition": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "exceptions": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3507&enactments=false", "penalty_summary": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=13-410&enactments=false", "substitute_notice": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "credit_bureau_text": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3506&enactments=false", "risk_of_harm_text": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3504&enactments=false", "glba_deemed_compliance": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3507&enactments=false", "private_right_of_action": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-3508&enactments=false" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Massachusetts", "code": "MA", "citation": "M.G.L. ch. 93H, §§ 1-6 (incl. §3A credit monitoring); 201 CMR 17.00 (WISP)", "citation_url": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "As soon as practicable and without unreasonable delay; may not delay because total # affected not yet known", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General + Director, Office of Consumer Affairs and Business Regulation (OCABR)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - every breach: AG and Director of Office of Consumer Affairs & Business Regulation (OCABR); plus CRAs/state agencies OCABR identifies; must state whether a WISP is maintained", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "As soon as practicable and without unreasonable delay", "regulator_timing_text": "As soon as practicable and without unreasonable delay (same standard as residents); send sample consumer notice to AG and OCABR", "credit_bureau_label": "Conditional (see rule)", "credit_bureau_required": "conditional", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "No numeric threshold - notify CRAs/state agencies identified by OCABR after it receives the breach notice", "risk_of_harm": "Yes", "risk_of_harm_text": "Built into breach definition (substantial risk of identity theft or fraud); no documentation/AG-filing requirement for no-notice decisions", "glba_deemed_compliance": "Yes - persons maintaining breach procedures under federal law/guidance deemed compliant if residents notified per those procedures AND AG/OCABR notified", "special_notes": "Notify the AG and OCABR for every breach; state whether you maintain a written information security program (WISP). OCABR identifies the CRAs/agencies to notify.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "consumer_deadline_text": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "regulator_required_text": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "regulator_timing_text": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "pi_definition_summary": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section1", "breach_definition": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section1", "exceptions": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section5", "penalty_summary": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section6", "substitute_notice": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section1", "credit_bureau_text": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3", "risk_of_harm_text": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section1", "glba_deemed_compliance": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section5", "private_right_of_action": "https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section6" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Michigan", "code": "MI", "citation": "MCL 445.63 (definitions) and 445.72 (breach notice) of the Identity Theft Protection Act, 2004 PA 452", "citation_url": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (delay allowed to determine scope/restore integrity or for law enforcement)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No - Michigan has no AG/regulator breach notice requirement for private entities", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A - no AG notice requirement", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 residents notified - notify nationwide CRAs without unreasonable delay (# and timing of notices); N/A to GLBA-subject entities", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no notice if entity determines breach has not/is not likely to cause substantial loss/injury or ID theft (ordinarily prudent person standard); no documentation/filing requirement", "glba_deemed_compliance": "Yes - financial institutions subject to Interagency Guidance (and NCUA) and affiliates deemed compliant; HIPAA-compliant entities deemed compliant", "special_notes": "SB 360 (2025) would add AG notice at 100+ residents; not law as of 9/30/2026.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "consumer_deadline_text": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "regulator_required_text": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "regulator_timing_text": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "pi_definition_summary": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-63", "breach_definition": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-63", "exceptions": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "penalty_summary": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "substitute_notice": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "credit_bureau_text": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "risk_of_harm_text": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "glba_deemed_compliance": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72", "private_right_of_action": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Minnesota", "code": "MN", "citation": "Minn. Stat. § 325E.61 (single section; government entities under § 13.055)", "citation_url": "https://www.revisor.mn.gov/statutes/cite/325E.61", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay (law-enforcement delay to date certain)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No - no AG/regulator notice for private entities; the >500 figure is the CRA-notice threshold", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A - no AG notice requirement (CRA notice within 48 hours if >500 persons)", "credit_bureau_label": "More than 500", "credit_bureau_required": "threshold", "credit_bureau_threshold": 500, "credit_bureau_operator": ">", "credit_bureau_text": ">500 persons at one time - notify all nationwide CRAs within 48 hours", "risk_of_harm": "No", "risk_of_harm_text": "No - notice required if unencrypted PI acquired or reasonably believed acquired; no harm-analysis exception", "glba_deemed_compliance": "Yes - GLBA financial institutions (15 USC 6809(3)) fully exempt from §325E.61", "special_notes": "Notify all nationwide CRAs within 48 hours if >500 persons. GLBA financial institutions (15 USC 6809(3)) are fully exempt.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.revisor.mn.gov/statutes/cite/325E.61", "consumer_deadline_text": "https://www.revisor.mn.gov/statutes/cite/325E.61", "regulator_required_text": "https://www.revisor.mn.gov/statutes/cite/325E.61", "regulator_timing_text": "https://www.revisor.mn.gov/statutes/cite/325E.61", "pi_definition_summary": "https://www.revisor.mn.gov/statutes/cite/325E.61", "breach_definition": "https://www.revisor.mn.gov/statutes/cite/325E.61", "exceptions": "https://www.revisor.mn.gov/statutes/cite/325E.61", "penalty_summary": "https://www.revisor.mn.gov/statutes/cite/325E.61", "substitute_notice": "https://www.revisor.mn.gov/statutes/cite/325E.61", "credit_bureau_text": "https://www.revisor.mn.gov/statutes/cite/325E.61", "risk_of_harm_text": "https://www.revisor.mn.gov/statutes/cite/325E.61", "glba_deemed_compliance": "https://www.revisor.mn.gov/statutes/cite/325E.61", "private_right_of_action": "https://www.revisor.mn.gov/statutes/cite/325E.61" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Mississippi", "code": "MS", "citation": "Miss. Code Ann. § 75-24-29", "citation_url": "http://billstatus.ls.state.ms.us/documents/2010/pdf/HB/0500-0599/HB0583SG.pdf", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (subject to investigation/scope/restore integrity; law-enforcement delay)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No AG/regulator notice required", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A (no AG notice)", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice not required if, after appropriate investigation, breach will not likely result in harm; no documentation/AG filing requirement", "glba_deemed_compliance": "Yes - entity following its primary or functional federal regulator's breach procedures deemed compliant (§ 75-24-29(7))", "special_notes": "2025 bills to add AG notice (SB2046/HB731) died in committee.", "verify_with_counsel": "", "source_type": "mirror", "source_note": "Official: enacted HB 583 (2010) on the Mississippi legislature site; the official code is LexisNexis-hosted.", "field_sources": { "citation": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "consumer_deadline_text": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "regulator_required_text": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "regulator_timing_text": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "pi_definition_summary": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "breach_definition": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "exceptions": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "penalty_summary": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "substitute_notice": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "credit_bureau_text": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "risk_of_harm_text": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "glba_deemed_compliance": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/", "private_right_of_action": "https://codes.findlaw.com/ms/title-75-regulation-of-trade-commerce-and-investments/ms-code-sect-75-24-29/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Missouri", "code": "MO", "citation": "Mo. Rev. Stat. § 407.1500", "citation_url": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Only if notice given to >1,000 consumers at one time: notify AG (and nationwide CRAs)", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Without unreasonable delay", "regulator_timing_text": "Without unreasonable delay (timing, distribution, content of notice)", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 consumers notified at one time: all nationwide CRAs, without unreasonable delay", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no notice if risk of identity theft/fraud not reasonably likely; determination must be documented in writing and kept 5 years", "glba_deemed_compliance": "Yes - regulator procedures, Federal Interagency Guidance, NCUA 12 CFR 748, GLBA compliance deemed compliant", "special_notes": "AG and CRAs only if >1,000 consumers notified at one time.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "consumer_deadline_text": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "regulator_required_text": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "regulator_timing_text": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "pi_definition_summary": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "breach_definition": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "exceptions": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "penalty_summary": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "substitute_notice": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "credit_bureau_text": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "risk_of_harm_text": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "glba_deemed_compliance": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500", "private_right_of_action": "https://revisor.mo.gov/main/OneSection.aspx?section=407.1500" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Montana", "code": "MT", "citation": "Mont. Code Ann. § 30-14-1704 (part of § 30-14-1701 et seq.)", "citation_url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "AG Office of Consumer Protection", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - any entity required to notify must submit electronic copy of notice + date/method of distribution + number of MT residents notified to AG Office of Consumer Protection", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "Simultaneously with notice to individuals", "regulator_timing_text": "Simultaneously with notice to individuals", "credit_bureau_label": "Conditional (see rule)", "credit_bureau_required": "conditional", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "No numeric threshold; if notice suggests obtaining credit file, must coordinate timing/content/distribution with CRA", "risk_of_harm": "Yes", "risk_of_harm_text": "Effectively yes - breach definition requires loss/injury or reasonable belief thereof; no documentation/AG filing requirement", "glba_deemed_compliance": "No GLBA/federal-regulator exemption (financial institutions are covered 'businesses'); only own-policy deemed compliance", "special_notes": "Submit an electronic copy of the notice, date/method of distribution and number of Montana residents to the AG Office of Consumer Protection simultaneously with individual notice.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "consumer_deadline_text": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "regulator_required_text": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "regulator_timing_text": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "pi_definition_summary": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "breach_definition": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "exceptions": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "penalty_summary": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "substitute_notice": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "credit_bureau_text": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "risk_of_harm_text": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "glba_deemed_compliance": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html", "private_right_of_action": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_0040/0300-0140-0170-0040.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Nebraska", "code": "NE", "citation": "Neb. Rev. Stat. § 87-801 et seq.", "citation_url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "As soon as possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - whenever resident notice is required (after risk-of-harm investigation)", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than notice to residents", "regulator_timing_text": "Not later than the time notice is provided to residents", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice only if investigation finds unauthorized use has occurred or is reasonably likely; no documentation/AG filing requirement", "glba_deemed_compliance": "Yes - regulated entity following primary/functional state or federal regulator procedures deemed compliant if it notifies residents and AG", "special_notes": "AG no later than notice to residents.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "consumer_deadline_text": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "regulator_required_text": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "regulator_timing_text": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "pi_definition_summary": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "breach_definition": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "exceptions": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "penalty_summary": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "substitute_notice": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "credit_bureau_text": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "risk_of_harm_text": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "glba_deemed_compliance": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803", "private_right_of_action": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-803" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Nevada", "code": "NV", "citation": "Nev. Rev. Stat. § 603A.010 et seq. (notice: § 603A.220)", "citation_url": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "None", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 persons at one time: nationwide CRAs, without unreasonable delay (§ 603A.220(6))", "risk_of_harm": "No", "risk_of_harm_text": "No", "glba_deemed_compliance": "Yes - GLBA-compliant data collector deemed compliant", "special_notes": "CRAs if >1,000 persons at one time.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "consumer_deadline_text": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "regulator_required_text": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "regulator_timing_text": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "pi_definition_summary": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "breach_definition": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "exceptions": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "penalty_summary": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "substitute_notice": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "credit_bureau_text": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "risk_of_harm_text": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "glba_deemed_compliance": "https://www.leg.state.nv.us/nrs/NRS-603A.html", "private_right_of_action": "https://www.leg.state.nv.us/nrs/NRS-603A.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "New Hampshire", "code": "NH", "citation": "N.H. Rev. Stat. Ann. § 359-C:19 to :21", "citation_url": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "As soon as possible / as quickly as possible after misuse determination", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General (or primary regulator for RSA 358-A:3, I entities)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - all breaches requiring notice; entities subject to RSA 358-A:3, I notify their primary regulator instead of AG; include anticipated notice date and approx. # of NH residents", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "No later than individual notice (the notice must state the anticipated date of individual notice)", "regulator_timing_text": "No express deadline; notice must state anticipated date of individual notice (i.e., given before/with individual notice)", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": ">1,000 consumers: nationwide CRAs without unreasonable delay; not applicable to GLBA-subject entities", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice unless determined misuse not reasonably likely; burden on entity to demonstrate compliance (§ 359-C:21, III); no AG filing of determination", "glba_deemed_compliance": "Partial - 358-A:3,I entities following regulator procedures deemed compliant; GLBA entities exempt from CRA notice only", "special_notes": "Entities subject to RSA 358-A:3, I notify their primary regulator instead of the AG.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "consumer_deadline_text": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "regulator_required_text": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "regulator_timing_text": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "pi_definition_summary": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "breach_definition": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "exceptions": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "penalty_summary": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "substitute_notice": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "credit_bureau_text": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "risk_of_harm_text": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "glba_deemed_compliance": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm", "private_right_of_action": "https://gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm" }, "last_verified": "2026-09-30" }, { "jurisdiction": "New Jersey", "code": "NJ", "citation": "N.J.S.A. 56:8-161 to -166 (breach notice at 56:8-163)", "citation_url": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay; no fixed day count", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Division of State Police", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes -- Division of State Police (Dept. of Law & Public Safety) for ALL breaches, BEFORE notifying customers. No separate AG notice.", "regulator_timing": "before", "regulator_timing_group": "Before consumer notice", "regulator_timing_short": "BEFORE notice to customers", "regulator_timing_text": "In advance of disclosure to customers", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons at one time -> all nationwide CRAs, without unreasonable delay", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes -- notice not required if misuse 'not reasonably possible'; determination documented in writing and retained 5 years (no AG filing)", "glba_deemed_compliance": "No GLBA-specific exemption; entity with own consistent notification policy deemed compliant", "special_notes": "Report to the Division of State Police BEFORE notifying customers. No separate AG notice in the statute.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "consumer_deadline_text": "https://pub.njleg.gov/Bills/2026/A2000/1852_I1.HTM", "regulator_required_text": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "regulator_timing_text": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "pi_definition_summary": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "breach_definition": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "exceptions": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "penalty_summary": "https://www.njconsumeraffairs.gov/Statutes/Consumer-Fraud-Act.pdf", "substitute_notice": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "credit_bureau_text": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "risk_of_harm_text": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "glba_deemed_compliance": "https://www.njconsumeraffairs.gov/Statutes/Identity-Theft-Prevention-Act.pdf", "private_right_of_action": "https://www.njconsumeraffairs.gov/Statutes/Consumer-Fraud-Act.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "New Mexico", "code": "NM", "citation": "N.M. Stat. Ann. 57-12C-1 to -12 (Data Breach Notification Act, 2017)", "citation_url": "https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible, but not later than 45 calendar days after discovery", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes -- AG (and nationwide CRAs) only if >1,000 NM residents notified from a single breach", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "No later than 45 calendar days", "regulator_timing_text": "Most expedient time possible, no later than 45 calendar days; include number of NM residents notified and a copy of the notice", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 NM residents -> nationwide CRAs within 45 days", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes -- no notice if investigation finds no significant risk of identity theft or fraud; no documentation/AG-filing requirement in statute", "glba_deemed_compliance": "Yes -- Act does not apply to persons subject to GLBA or HIPAA (full exemption)", "special_notes": "AG and CRAs if >1,000 within 45 days. Persons subject to GLBA or HIPAA are fully exempt.", "verify_with_counsel": "", "source_type": "mirror", "source_note": "Official: enacted HB 15 (2017) on nmlegis.gov; current compiled text via a code mirror (official compilation not freely linkable).", "field_sources": { "citation": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/", "consumer_deadline_text": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-6/", "regulator_required_text": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-10/", "regulator_timing_text": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-10/", "pi_definition_summary": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-2/", "breach_definition": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-2/", "exceptions": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-8/", "penalty_summary": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-11/", "substitute_notice": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-6/", "credit_bureau_text": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-10/", "risk_of_harm_text": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-6/", "glba_deemed_compliance": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-8/", "private_right_of_action": "https://codes.findlaw.com/nm/chapter-57-trade-practices-and-regulations/nm-st-sect-57-12c-11/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "New York", "code": "NY", "citation": "N.Y. Gen. Bus. Law 899-aa (notice), 899-bb (safeguards); 23 NYCRR 500.17 for DFS-covered entities", "citation_url": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible and without unreasonable delay, but no later than 30 days after discovery (law-enforcement delay only)", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "Attorney General + Dept. of State + Division of State Police (+ DFS if a Part 500 covered entity)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes -- for ANY NY resident notified: AG, Department of State, Division of State Police; plus DFS if a Part 500 covered entity. >500 residents inadvertent-disclosure determination to AG", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "No statutory day count (DFS: 72 hours under 23 NYCRR 500.17 - see the incident notification deadlines page)", "regulator_timing_text": "No statutory day count for AG/DOS/State Police (notice of timing, content, distribution, approx. number); DFS covered entities: 72 hrs under 500.17; inadvertent-disclosure determination to AG within 10 days if >500 residents", "credit_bureau_label": "More than 5,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 5000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 5,000 NY residents at one time -> CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes, limited: inadvertent disclosure by authorized persons; written determination kept 5 years; provided to AG within 10 days if >500 residents", "glba_deemed_compliance": "Deemed compliance for individual notice under GLBA/HIPAA/Part 500/etc., but AG, DOS, State Police (and DFS) notice still required", "special_notes": "30 days after discovery (L.2024 ch.647). Notify the AG, Dept. of State and State Police for any NY resident notified; DFS too if a 23 NYCRR 500 covered entity (72-hour clock; see the incident notification deadlines page). If relying on the inadvertent-disclosure no-harm determination for >500 residents, file it with the AG within 10 days. CRAs if >5,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "consumer_deadline_text": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "regulator_required_text": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "regulator_timing_text": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "pi_definition_summary": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "breach_definition": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "exceptions": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "penalty_summary": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "substitute_notice": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "credit_bureau_text": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "risk_of_harm_text": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "glba_deemed_compliance": "https://www.nysenate.gov/legislation/laws/GBS/899-AA", "private_right_of_action": "https://www.nysenate.gov/legislation/laws/GBS/899-AA" }, "last_verified": "2026-09-30" }, { "jurisdiction": "North Carolina", "code": "NC", "citation": "N.C. Gen. Stat. 75-60 to 75-66 (breach notice at 75-65)", "citation_url": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (law-enforcement/scope measures)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "AG Consumer Protection Division", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes -- Consumer Protection Division of AG for EVERY breach where individual notice is given (no threshold)", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Without unreasonable delay", "regulator_timing_text": "Without unreasonable delay", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons at one time -> nationwide CRAs (and AG CPD) without unreasonable delay", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes -- built into breach definition (illegal use reasonably likely / material risk of harm); no documentation or AG filing requirement", "glba_deemed_compliance": "Yes -- financial institutions/credit unions subject to and complying with 2005 federal interagency guidance deemed compliant", "special_notes": "AG Consumer Protection Division for every notifiable breach; CRAs if >1,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "consumer_deadline_text": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "regulator_required_text": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "regulator_timing_text": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "pi_definition_summary": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-61.html", "breach_definition": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-61.html", "exceptions": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "penalty_summary": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "substitute_notice": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "credit_bureau_text": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "risk_of_harm_text": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-61.html", "glba_deemed_compliance": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html", "private_right_of_action": "https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "North Dakota", "code": "ND", "citation": "N.D. Cent. Code 51-30-01 to 51-30-07", "citation_url": "https://ndlegis.gov/cencode/t51c30.pdf", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 250 residents", "regulator_required": "threshold", "regulator_threshold": 250, "threshold_operator": ">", "regulator_required_text": "Yes -- AG (mail or email) if breach exceeds 250 individuals", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Most expedient time possible, without unreasonable delay", "regulator_timing_text": "Most expedient time possible and without unreasonable delay", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None -- no CRA notice requirement", "risk_of_harm": "No", "risk_of_harm_text": "No -- no risk-of-harm exception", "glba_deemed_compliance": "Yes -- deemed compliance for FIs/trust cos./credit unions complying with federal interagency guidance; HIPAA covered entities/BAs", "special_notes": "AG if >250. DFI-regulated non-bank financial corporations also notify the DFI Commissioner for breaches of 500 or more consumers (HB 1127, eff. 8/1/2025).", "verify_with_counsel": "Verify with counsel: private right of action: Untested for breach-notice claims.", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://ndlegis.gov/cencode/t51c30.pdf", "consumer_deadline_text": "https://ndlegis.gov/cencode/t51c30.pdf", "regulator_required_text": "https://ndlegis.gov/cencode/t51c30.pdf", "regulator_timing_text": "https://ndlegis.gov/cencode/t51c30.pdf", "pi_definition_summary": "https://ndlegis.gov/cencode/t51c30.pdf", "breach_definition": "https://ndlegis.gov/cencode/t51c30.pdf", "exceptions": "https://ndlegis.gov/cencode/t51c30.pdf", "penalty_summary": "https://ndlegis.gov/cencode/t51c30.pdf", "substitute_notice": "https://ndlegis.gov/cencode/t51c30.pdf", "credit_bureau_text": "https://ndlegis.gov/cencode/t51c30.pdf", "risk_of_harm_text": "https://ndlegis.gov/cencode/t51c30.pdf", "glba_deemed_compliance": "https://ndlegis.gov/cencode/t51c30.pdf", "private_right_of_action": "https://ndlegis.gov/cencode/t51c30.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Ohio", "code": "OH", "citation": "Ohio Rev. Code 1349.19 (1349.191-.192 enforcement)", "citation_url": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible but not later than 45 days after discovery", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No -- no AG/regulator notice requirement (only CRAs if >1,000)", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A -- no AG notice", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 Ohio residents in a single breach -> nationwide CRAs without unreasonable delay", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes -- notice only if material risk of identity theft or other fraud; no documentation/AG-filing requirement", "glba_deemed_compliance": "Yes -- full exemption for financial institutions/trust cos./credit unions (and affiliates) required by federal law to notify and examined by functional regulator; HIPAA covered entities exempt", "special_notes": "Financial institutions required by federal law to notify and examined by their functional regulator, and HIPAA covered entities, are exempt.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "consumer_deadline_text": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "regulator_required_text": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "regulator_timing_text": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "pi_definition_summary": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "breach_definition": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "exceptions": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "penalty_summary": "https://codes.ohio.gov/ohio-revised-code/section-1349.192", "substitute_notice": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "credit_bureau_text": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "risk_of_harm_text": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "glba_deemed_compliance": "https://codes.ohio.gov/ohio-revised-code/section-1349.19", "private_right_of_action": "https://codes.ohio.gov/ohio-revised-code/section-1349.192" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Oklahoma", "code": "OK", "citation": "24 O.S. §§ 161-166 (Security Breach Notification Act, as amended by SB 626 (2025))", "citation_url": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (subject to law-enforcement delay/scope determination); only where breach causes or is reasonably believed to cause identity theft/fraud", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "500 or more residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">=", "regulator_required_text": "Yes if 500+ OK residents affected in a single breach (1,000+ if breached entity is a credit bureau); fewer exempt", "regulator_timing": "after_individual", "regulator_timing_group": "After consumer notice", "regulator_timing_short": "No later than 60 days after notifying residents", "regulator_timing_text": "Without unreasonable delay, but no later than 60 days after notifying residents; must include date, nature, PI types, # residents, est. monetary impact, safeguards used", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None for general entities (SB 626's 1,000 figure is the AG-notice exemption for breached credit bureaus, not CRA notice)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice only if breach causes or reasonably believed to cause identity theft/fraud; no documentation or AG-filing requirement for no-notify decision", "glba_deemed_compliance": "Yes - GLBA/Interagency Guidance FIs and primary/functional federal regulator compliers deemed compliant, but only if they also give AG notice (SB 626); state-chartered FIs enforced by state regulator", "special_notes": "SB 626 (eff. 1/1/2026): AG if 500+ residents (1,000+ if the breached entity is a credit bureau), no later than 60 days after notifying residents. GLBA/HIPAA deemed compliance applies only if the AG is also notified.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "consumer_deadline_text": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "regulator_required_text": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "regulator_timing_text": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "pi_definition_summary": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "breach_definition": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "exceptions": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "penalty_summary": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "substitute_notice": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "credit_bureau_text": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "risk_of_harm_text": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "glba_deemed_compliance": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF", "private_right_of_action": "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Oregon", "code": "OR", "citation": "ORS 646A.600-646A.628 (notice at ORS 646A.604)", "citation_url": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expeditious manner, without unreasonable delay, but no later than 45 days after discovery/notification of breach", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 250 residents", "regulator_required": "threshold", "regulator_threshold": 250, "threshold_operator": ">", "regulator_required_text": "Yes - AG (writing or electronic) if more than 250 OR consumers; vendors also notify AG if >250 or unknown count; even exempt (GLBA/HIPAA/federal) entities must send AG a copy of notice if >250", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "No separate AG clock; the 45-day outer limit is commonly read as applying - plan for it", "regulator_timing_text": "No separate AG deadline; 45-day outer limit in 646A.604(3) applies to 'notice of the breach' (read as applying to AG); exempt entities: 'within a reasonable time'", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 consumers - notify nationwide CRAs without unreasonable delay (include police report #)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no consumer notice if reasonably determined unlikely to suffer harm after investigation/LE consultation; document in writing, retain 5 years", "glba_deemed_compliance": "Yes - GLBA Title V, HIPAA/HITECH, and primary/functional federal regulator compliers exempt; must still send AG copy of notice if >250", "special_notes": "Even GLBA/HIPAA/federal-regulator-exempt entities must send the AG a copy of the notice if >250.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "consumer_deadline_text": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "regulator_required_text": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "regulator_timing_text": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "pi_definition_summary": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "breach_definition": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "exceptions": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "penalty_summary": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "substitute_notice": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "credit_bureau_text": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "risk_of_harm_text": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "glba_deemed_compliance": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html", "private_right_of_action": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Pennsylvania", "code": "PA", "citation": "73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act, Act 94 of 2005, as amended by Act 151 of 2022 and Act 33 of 2024)", "citation_url": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay following determination of breach (State agencies/contractors & counties/schools/municipalities: within 7 business days)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes - AG if notice must go to more than 500 PA residents (entities subject to 40 Pa.C.S. Ch. 45 insurance data security exempt); State agencies notify AG concurrently regardless of count", "regulator_timing": "concurrent", "regulator_timing_group": "No later than consumer notice", "regulator_timing_short": "Concurrently with individual notice", "regulator_timing_text": "Concurrently with individual notice; must include org name/location, breach date, summary, total and PA affected counts", "credit_bureau_label": "More than 500", "credit_bureau_required": "threshold", "credit_bureau_threshold": 500, "credit_bureau_operator": ">", "credit_bureau_text": "More than 500 persons at one time (lowered from 1,000 by Act 33 of 2024, eff. 9/26/2024); also 12 months free credit monitoring + credit report when SSN, bank account #, or DL/State ID exposed (Act 33 § 5.4)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - embedded in breach definition (causes or reasonably believed to cause loss or injury); no documentation/AG-filing requirement", "glba_deemed_compliance": "Yes - FIs complying with Interagency Guidance; entities complying with primary state or functional federal regulator; HIPAA covered entities/BAs deemed compliant", "special_notes": "Act 33 of 2024 (eff. 9/26/2024): AG concurrently if >500; CRAs if >500. Offer 12 months of free credit monitoring and a credit report when SSN, bank account number or DL/state ID is exposed.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "consumer_deadline_text": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "regulator_required_text": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "regulator_timing_text": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "pi_definition_summary": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "breach_definition": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "exceptions": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "penalty_summary": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "substitute_notice": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "credit_bureau_text": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "risk_of_harm_text": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "glba_deemed_compliance": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0", "private_right_of_action": "https://www.palegis.us/statutes/unconsolidated/law-information/view-statute?txtType=HTM&SessYr=2005&ActNum=0094.&SessInd=0" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Rhode Island", "code": "RI", "citation": "R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015)", "citation_url": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible, no later than 45 calendar days after confirmation of breach (state/municipal agencies: 30 days); only if breach poses significant risk of identity theft", "consumer_clock_start": "confirmation of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes - AG (and major CRAs) if more than 500 RI residents notified", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "No fixed deadline; do not delay resident notice", "regulator_timing_text": "No fixed deadline; notify AG as to timing/content/distribution/approx. number without delaying resident notice", "credit_bureau_label": "More than 500", "credit_bureau_required": "threshold", "credit_bureau_threshold": 500, "credit_bureau_operator": ">", "credit_bureau_text": "More than 500 RI residents - notify major CRAs (same trigger as AG), without delaying resident notice", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice required only if breach poses significant risk of identity theft; no documentation/AG-filing requirement", "glba_deemed_compliance": "Yes - primary/functional federal regulator procedures; FIs examined and found compliant with Interagency Guidance; HIPAA covered entities deemed compliant", "special_notes": "45 calendar days for private persons (30 for state/municipal agencies). AG and CRAs if >500.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "consumer_deadline_text": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "regulator_required_text": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "regulator_timing_text": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "pi_definition_summary": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-3.htm", "breach_definition": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-3.htm", "exceptions": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-6.htm", "penalty_summary": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-5.htm", "substitute_notice": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-3.htm", "credit_bureau_text": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "risk_of_harm_text": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm", "glba_deemed_compliance": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-6.htm", "private_right_of_action": "https://webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-5.htm" }, "last_verified": "2026-09-30" }, { "jurisdiction": "South Carolina", "code": "SC", "citation": "S.C. Code Ann. § 39-1-90", "citation_url": "https://www.scstatehouse.gov/code/t39c001.php", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay (no fixed day count); only where illegal use occurred/reasonably likely or material risk of harm", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Dept. of Consumer Affairs, Consumer Protection Division", "regulator_threshold_label": "More than 1,000 residents", "regulator_required": "threshold", "regulator_threshold": 1000, "threshold_operator": ">", "regulator_required_text": "Yes - Consumer Protection Division of the Dept. of Consumer Affairs (not AG) plus nationwide CRAs, if notice goes to more than 1,000 persons at one time", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Without unreasonable delay", "regulator_timing_text": "Without unreasonable delay (DCA notice)", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons at one time - notify nationwide CRAs and DCA Consumer Protection Division", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice only if illegal use occurred/reasonably likely or material risk of harm; no documentation requirement", "glba_deemed_compliance": "Yes - banks/FIs subject to and compliant with GLBA exempt; Interagency Guidance compliance deemed compliant", "special_notes": "Regulator is the Dept. of Consumer Affairs (not the AG), and CRAs, if >1,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://www.scstatehouse.gov/code/t39c001.php", "consumer_deadline_text": "https://www.scstatehouse.gov/code/t39c001.php", "regulator_required_text": "https://www.scstatehouse.gov/code/t39c001.php", "regulator_timing_text": "https://www.scstatehouse.gov/code/t39c001.php", "pi_definition_summary": "https://www.scstatehouse.gov/code/t39c001.php", "breach_definition": "https://www.scstatehouse.gov/code/t39c001.php", "exceptions": "https://www.scstatehouse.gov/code/t39c001.php", "penalty_summary": "https://www.scstatehouse.gov/code/t39c001.php", "substitute_notice": "https://www.scstatehouse.gov/code/t39c001.php", "credit_bureau_text": "https://www.scstatehouse.gov/code/t39c001.php", "risk_of_harm_text": "https://www.scstatehouse.gov/code/t39c001.php", "glba_deemed_compliance": "https://www.scstatehouse.gov/code/t39c001.php", "private_right_of_action": "https://www.scstatehouse.gov/code/t39c001.php" }, "last_verified": "2026-09-30" }, { "jurisdiction": "South Dakota", "code": "SD", "citation": "S.D. Codified Laws §§ 22-40-19 to 22-40-26", "citation_url": "https://sdlegislature.gov/api/Statutes/22-40-19.html", "consumer_deadline": "60 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 60, "consumer_day_basis": "calendar", "consumer_deadline_text": "No later than 60 days from discovery/notification (longer only for law-enforcement delay; then within 30 days after LE clears)", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 250 residents", "regulator_required": "threshold", "regulator_threshold": 250, "threshold_operator": ">", "regulator_required_text": "Yes - AG (mail or email) if breach exceeds 250 SD residents; also AG notice required before relying on risk-of-harm exception (any size)", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "No statutory AG deadline (align with 60-day consumer notice)", "regulator_timing_text": "No specific AG deadline in statute", "credit_bureau_label": "Any breach", "credit_bureau_required": "all", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "Any breach requiring resident notice - notify all nationwide CRAs without unreasonable delay (no threshold)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - only after appropriate investigation AND notice to AG; written documentation retained 3 years", "glba_deemed_compliance": "Yes - entities regulated by federal law (HIPAA, GLBA) following primary/functional federal regulator procedures deemed compliant", "special_notes": "AG if >250. AG notice is also required before relying on the risk-of-harm exception (any size); keep the determination 3 years. CRAs for every notifiable breach.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://sdlegislature.gov/api/Statutes/22-40-19.html", "consumer_deadline_text": "https://sdlegislature.gov/api/Statutes/22-40-20.html", "regulator_required_text": "https://sdlegislature.gov/api/Statutes/22-40-20.html", "regulator_timing_text": "https://sdlegislature.gov/api/Statutes/22-40-20.html", "pi_definition_summary": "https://sdlegislature.gov/api/Statutes/22-40-19.html", "breach_definition": "https://sdlegislature.gov/api/Statutes/22-40-19.html", "exceptions": "https://sdlegislature.gov/api/Statutes/22-40-26.html", "penalty_summary": "https://sdlegislature.gov/api/Statutes/22-40-25.html", "substitute_notice": "https://sdlegislature.gov/api/Statutes/22-40-22.html", "credit_bureau_text": "https://sdlegislature.gov/api/Statutes/22-40-24.html", "risk_of_harm_text": "https://sdlegislature.gov/api/Statutes/22-40-20.html", "glba_deemed_compliance": "https://sdlegislature.gov/api/Statutes/22-40-26.html", "private_right_of_action": "https://sdlegislature.gov/api/Statutes/22-40-25.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Tennessee", "code": "TN", "citation": "Tenn. Code Ann. § 47-18-2107 (enforcement §§ 47-18-2105, -2106)", "citation_url": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Immediately, but no later than 45 days from discovery/notification (LE delay: 45 days after LE clearance)", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "None - statute has no AG/regulator notice requirement", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A - no AG notice", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "> 1,000 persons at one time -> all nationwide CRAs", "risk_of_harm": "No", "risk_of_harm_text": "No risk-of-harm analysis; notice triggered by breach of system security", "glba_deemed_compliance": "Yes - full exemption for entities subject to GLBA Title V or HIPAA/HITECH", "special_notes": "No AG notice (2018 HB2508 never enacted). Persons subject to GLBA Title V or HIPAA are exempt.", "verify_with_counsel": "Verify with counsel: penalties: TCPA civil-penalty amounts (47-18-2105) were seen only in a search snippet, not statute text.", "source_type": "mirror", "source_note": "Official Tennessee code is LexisNexis-hosted; FindLaw code mirror used.", "field_sources": { "citation": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "consumer_deadline_text": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "regulator_required_text": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "regulator_timing_text": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "pi_definition_summary": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "breach_definition": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "exceptions": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "penalty_summary": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "substitute_notice": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "credit_bureau_text": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "risk_of_harm_text": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "glba_deemed_compliance": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/", "private_right_of_action": "https://codes.findlaw.com/tn/title-47-commercial-instruments-and-transactions/tn-code-sect-47-18-2107/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Texas", "code": "TX", "citation": "Tex. Bus. & Com. Code § 521.053 (defs § 521.002; penalties § 521.151)", "citation_url": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "consumer_deadline": "60 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 60, "consumer_day_basis": "calendar", "consumer_deadline_text": "Without unreasonable delay, no later than 60 days after determining the breach occurred", "consumer_clock_start": "determination that the breach occurred", "regulator_recipients": "Attorney General (electronic form)", "regulator_threshold_label": "250 or more residents", "regulator_required": "threshold", "regulator_threshold": 250, "threshold_operator": ">=", "regulator_required_text": "Yes - if breach involves at least 250 TX residents", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "No later than 30 days after determination", "regulator_timing_text": "As soon as practicable, no later than 30 days after determining breach occurred; submitted electronically via AG website form", "credit_bureau_label": "More than 10,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 10000, "credit_bureau_operator": ">", "credit_bureau_text": "> 10,000 persons at one time -> nationwide CRAs, without unreasonable delay", "risk_of_harm": "No", "risk_of_harm_text": "No risk-of-harm analysis", "glba_deemed_compliance": "No GLBA/federal-regulator exemption from § 521.053 (own-policy compliance safe harbor only)", "special_notes": "AG via the AG electronic form if at least 250 Texans, no later than 30 days after determination (SB 768, eff. 9/1/2023). CRAs if >10,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "consumer_deadline_text": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "regulator_required_text": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "regulator_timing_text": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "pi_definition_summary": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "breach_definition": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "exceptions": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "penalty_summary": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "substitute_notice": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "credit_bureau_text": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "risk_of_harm_text": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "glba_deemed_compliance": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm", "private_right_of_action": "https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Utah", "code": "UT", "citation": "Utah Code §§ 13-44-101 to -301 (notice § 13-44-202)", "citation_url": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible without unreasonable delay (no fixed day count), after investigation finds misuse occurred or reasonably likely", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General + Utah Cyber Center", "regulator_threshold_label": "500 or more residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">=", "regulator_required_text": "Yes - AG AND Utah Cyber Center if misuse of PI of 500 or more UT residents has occurred or is reasonably likely", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Most expedient time possible without unreasonable delay", "regulator_timing_text": "No fixed deadline - same 'most expedient time possible without unreasonable delay' standard; must include breach/discovery dates, counts, PI types, description", "credit_bureau_label": "1,000 or more", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">=", "credit_bureau_text": "1,000 or more UT residents (misuse likely) -> nationwide CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - mandatory good-faith prompt investigation; notice only if misuse for identity theft/fraud occurred or reasonably likely; no AG filing of no-harm determination", "glba_deemed_compliance": "Yes - person regulated by state/federal law following primary regulator's breach procedures deemed compliant (§ 13-44-202(5)(c))", "special_notes": "AG and Utah Cyber Center if 500 or more residents; CRAs if 1,000 or more.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "consumer_deadline_text": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "regulator_required_text": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "regulator_timing_text": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "pi_definition_summary": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S102_2019051420190514.html", "breach_definition": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S102_2019051420190514.html", "exceptions": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "penalty_summary": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S301_2025050720250507.html", "substitute_notice": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "credit_bureau_text": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "risk_of_harm_text": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "glba_deemed_compliance": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S202_2024050120240501.html", "private_right_of_action": "https://le.utah.gov/xcode/Title13/Chapter44/C13-44-S301_2025050720250507.html" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Vermont", "code": "VT", "citation": "9 V.S.A. § 2435 (defs § 2430)", "citation_url": "https://legislature.vermont.gov/statutes/section/09/062/02435", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time possible, no later than 45 days after discovery/notification", "consumer_clock_start": "discovery or notification of the breach", "regulator_recipients": "Attorney General (or Dept. of Financial Regulation if DFR-regulated)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - all breaches; to AG, or to Dept. of Financial Regulation (DFR) if data collector is regulated by DFR under Title 8/Title 9", "regulator_timing": "earlier_of", "regulator_timing_group": "Fixed days or at consumer notice, whichever is first", "regulator_timing_short": "Preliminary notice within 14 business days of discovery or at consumer notice, whichever is sooner", "regulator_timing_text": "Preliminary notice within 14 BUSINESS days of discovery or at consumer notice, whichever sooner (pre-sworn policy filers: before consumer notice); plus count + copy of consumer notice when consumers notified", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "> 1,000 consumers at one time -> nationwide CRAs (not applicable to DFR Title 8 licensees)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - may skip notice if misuse not reasonably possible, but must file determination + detailed explanation with AG/DFR", "glba_deemed_compliance": "Yes - FIs subject to 2005 federal Interagency Guidance (or NCUA guidance) exempt; DFR-regulated FIs must notify DFR ASAP", "special_notes": "Preliminary notice to the AG (or DFR if DFR-regulated) within 14 business days of discovery or at consumer notice, whichever is sooner, then a second filing with the count and a copy of the consumer notice. A no-harm determination must be filed with the AG/DFR.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://legislature.vermont.gov/statutes/section/09/062/02435", "consumer_deadline_text": "https://legislature.vermont.gov/statutes/section/09/062/02435", "regulator_required_text": "https://legislature.vermont.gov/statutes/section/09/062/02435", "regulator_timing_text": "https://legislature.vermont.gov/statutes/section/09/062/02435", "pi_definition_summary": "https://legislature.vermont.gov/statutes/section/09/062/02430", "breach_definition": "https://legislature.vermont.gov/statutes/section/09/062/02435", "exceptions": "https://legislature.vermont.gov/statutes/section/09/062/02435", "penalty_summary": "https://legislature.vermont.gov/statutes/section/09/063/02458", "substitute_notice": "https://legislature.vermont.gov/statutes/section/09/062/02435", "credit_bureau_text": "https://legislature.vermont.gov/statutes/section/09/062/02435", "risk_of_harm_text": "https://legislature.vermont.gov/statutes/section/09/062/02435", "glba_deemed_compliance": "https://legislature.vermont.gov/statutes/section/09/062/02435", "private_right_of_action": "https://legislature.vermont.gov/statutes/section/09/062/02435" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Virginia", "code": "VA", "citation": "Va. Code § 18.2-186.6", "citation_url": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (reasonable delay to determine scope/restore; LE delay)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Attorney General", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - AG must be notified of EVERY notifiable breach (§ 18.2-186.6(B)); additional AG + CRA notice of timing/distribution/content if > 1,000 residents notified at one time (E)", "regulator_timing": "no_fixed", "regulator_timing_group": "No fixed regulator deadline", "regulator_timing_short": "Without unreasonable delay", "regulator_timing_text": "Without unreasonable delay (same as residents); AG only - no State Police requirement", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "> 1,000 persons at one time -> AG and nationwide CRAs", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice only if breach causes or reasonably believed to cause identity theft/fraud; no AG filing of no-harm determination", "glba_deemed_compliance": "Yes - GLBA Title V entities with compliant procedures deemed compliant; primary/functional regulator compliance also deemed compliant", "special_notes": "AG for every notifiable breach; an additional AG and CRA notice if >1,000 at one time.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "consumer_deadline_text": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "regulator_required_text": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "regulator_timing_text": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "pi_definition_summary": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "breach_definition": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "exceptions": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "penalty_summary": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "substitute_notice": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "credit_bureau_text": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "risk_of_harm_text": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "glba_deemed_compliance": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/", "private_right_of_action": "https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Washington", "code": "WA", "citation": "RCW 19.255.005-.040 (chapter 19.255 RCW); last amended 2019 c 241 (HB 1071, eff. 3/1/2020); no 2023-2026 amendments", "citation_url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "consumer_deadline": "30 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 30, "consumer_day_basis": "calendar", "consumer_deadline_text": "Most expedient time, no more than 30 calendar days after discovery (law-enforcement delay allowed)", "consumer_clock_start": "discovery of the breach", "regulator_recipients": "Attorney General", "regulator_threshold_label": "More than 500 residents", "regulator_required": "threshold", "regulator_threshold": 500, "threshold_operator": ">", "regulator_required_text": "Yes - AG if notifying >500 WA residents from a single breach; HIPAA covered entities and federally regulated banks/CUs must also notify AG", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "No more than 30 days after discovery", "regulator_timing_text": "No more than 30 days after discovery; must update AG if info unknown at time of notice", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None (notice must list CRA contact numbers, but no CRA notification duty)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no notice if breach not reasonably likely to subject consumers to risk of harm; no documentation/AG filing requirement", "glba_deemed_compliance": "Yes - federally regulated banks/CUs complying with interagency guidance and 12 CFR 30/208/225/364/748 deemed compliant; HIPAA covered entities too; both must notify AG", "special_notes": "AG if >500, within 30 days after discovery; update the AG if information was unknown at the time of notice.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "consumer_deadline_text": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "regulator_required_text": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "regulator_timing_text": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "pi_definition_summary": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.005", "breach_definition": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.005", "exceptions": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.030", "penalty_summary": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.040", "substitute_notice": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "credit_bureau_text": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "risk_of_harm_text": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010", "glba_deemed_compliance": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.030", "private_right_of_action": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.040" }, "last_verified": "2026-09-30" }, { "jurisdiction": "West Virginia", "code": "WV", "citation": "W. Va. Code §§ 46A-2A-101 to -105; enacted 2008 SB 340; no later amendments", "citation_url": "https://code.wvlegislature.gov/46A-2A-102/", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (law-enforcement delay allowed)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No - statute has no AG/regulator notice requirement (CRA notice only if >1,000 persons)", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "More than 1,000", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">", "credit_bureau_text": "More than 1,000 persons: notify nationwide CRAs of timing, distribution, content (GLBA-subject entities exempt)", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - notice only if entity reasonably believes breach caused/will cause ID theft or fraud; no documentation requirement", "glba_deemed_compliance": "Yes - FIs complying with Federal Interagency Guidance deemed compliant; any entity complying with primary/functional regulator's rules deemed compliant", "special_notes": "CRAs if >1,000.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://code.wvlegislature.gov/46A-2A-102/", "consumer_deadline_text": "https://code.wvlegislature.gov/46A-2A-102/", "regulator_required_text": "https://code.wvlegislature.gov/46A-2A-102/", "regulator_timing_text": "https://code.wvlegislature.gov/46A-2A-102/", "pi_definition_summary": "https://code.wvlegislature.gov/46A-2A-101/", "breach_definition": "https://code.wvlegislature.gov/46A-2A-101/", "exceptions": "https://code.wvlegislature.gov/46A-2A-103/", "penalty_summary": "https://code.wvlegislature.gov/46A-2A-104/", "substitute_notice": "https://code.wvlegislature.gov/46A-2A-101/", "credit_bureau_text": "https://code.wvlegislature.gov/46A-2A-102/", "risk_of_harm_text": "https://code.wvlegislature.gov/46A-2A-102/", "glba_deemed_compliance": "https://code.wvlegislature.gov/46A-2A-103/", "private_right_of_action": "https://code.wvlegislature.gov/46A-2A-104/" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Wisconsin", "code": "WI", "citation": "Wis. Stat. § 134.98; last amended 2007 Act 97; statutes current through 2025 Act 247 (Sept 2026)", "citation_url": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "consumer_deadline": "45 calendar days", "consumer_deadline_type": "fixed_days", "consumer_days": 45, "consumer_day_basis": "calendar", "consumer_deadline_text": "Reasonable time, not to exceed 45 days after entity learns of acquisition", "consumer_clock_start": "learning of the acquisition", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No AG notice (CRA notice if 1,000+ individuals)", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "1,000 or more", "credit_bureau_required": "threshold", "credit_bureau_threshold": 1000, "credit_bureau_operator": ">=", "credit_bureau_text": "1,000+ individuals: notify all nationwide CRAs of timing, distribution, content", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - no notice if acquisition does not create material risk of ID theft or fraud; no documentation requirement", "glba_deemed_compliance": "Yes - entities subject to GLBA (15 USC 6801-6827) or HIPAA are exempt", "special_notes": "CRAs if 1,000 or more individuals.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "consumer_deadline_text": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "regulator_required_text": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "regulator_timing_text": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "pi_definition_summary": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "breach_definition": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "exceptions": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "penalty_summary": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "substitute_notice": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "credit_bureau_text": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "risk_of_harm_text": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "glba_deemed_compliance": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98", "private_right_of_action": "https://docs.legis.wisconsin.gov/statutes/statutes/134/98" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Wyoming", "code": "WY", "citation": "Wyo. Stat. §§ 40-12-501 to -502 (PI elements by reference to § 6-3-901(b)); last substantive amendment 2015 (Laws 2015 ch. 63, SF 35/36)", "citation_url": "https://wyoleg.gov/statutes/compress/title40.pdf", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time, without unreasonable delay, after good-faith investigation (law-enforcement delay)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "No - no AG or regulator notice requirement (AG enforcement only)", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - mandatory good-faith investigation; notice only if misuse occurred or reasonably likely; no documentation/AG filing", "glba_deemed_compliance": "Yes - GLBA FIs / federal CUs following 12 CFR 364 App. B / 748 App. B; HIPAA covered entities and BAs", "special_notes": "No regulator notice; AG enforces.", "verify_with_counsel": "", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://wyoleg.gov/statutes/compress/title40.pdf", "consumer_deadline_text": "https://wyoleg.gov/statutes/compress/title40.pdf", "regulator_required_text": "https://wyoleg.gov/statutes/compress/title40.pdf", "regulator_timing_text": "https://wyoleg.gov/statutes/compress/title40.pdf", "pi_definition_summary": "https://wyoleg.gov/statutes/compress/title40.pdf", "breach_definition": "https://wyoleg.gov/statutes/compress/title40.pdf", "exceptions": "https://wyoleg.gov/statutes/compress/title40.pdf", "penalty_summary": "https://wyoleg.gov/statutes/compress/title40.pdf", "substitute_notice": "https://wyoleg.gov/statutes/compress/title40.pdf", "credit_bureau_text": "https://wyoleg.gov/statutes/compress/title40.pdf", "risk_of_harm_text": "https://wyoleg.gov/statutes/compress/title40.pdf", "glba_deemed_compliance": "https://wyoleg.gov/statutes/compress/title40.pdf", "private_right_of_action": "https://wyoleg.gov/statutes/compress/title40.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Puerto Rico", "code": "PR", "citation": "10 L.P.R.A. §§ 4051-4055 (Citizen Information on Data Banks Security Act, Act 111-2005, as amended by Act 97-2008)", "citation_url": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "As expeditiously as possible, considering law-enforcement needs and measures to restore system security (§ 4052)", "consumer_clock_start": "No fixed day count", "regulator_recipients": "Dept. of Consumer Affairs (DACO)", "regulator_threshold_label": "No threshold", "regulator_required": "all", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "Yes - Dept. of Consumer Affairs (DACO) for any breach requiring notice (§ 4052); government agencies notify the Citizen's Advocate Office (§ 4054a)", "regulator_timing": "from_trigger", "regulator_timing_group": "Fixed days from discovery or determination", "regulator_timing_short": "Within a non-extendable 10 days after the breach is detected", "regulator_timing_text": "Within a non-extendable term of 10 days after the breach is detected; DACO makes a public announcement within 24 hours (§ 4052)", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None in statute", "risk_of_harm": "No", "risk_of_harm_text": "No - notice on detected unauthorized access to unencrypted files", "glba_deemed_compliance": "No GLBA-specific exemption; existing institutional policies with equal or better protection are not prejudiced (§ 4054)", "special_notes": "Notify DACO within a non-extendable 10 days after the breach is detected; DACO announces it publicly within 24 hours. Government agencies notify the Citizen's Advocate Office instead.", "verify_with_counsel": "Verify with counsel: Statute text from a 2017 LexisNexis printout (code mirror); amendments after 2017 not checked.", "source_type": "mirror", "source_note": "", "field_sources": { "citation": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "consumer_deadline_text": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "regulator_required_text": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "regulator_timing_text": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "pi_definition_summary": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "breach_definition": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "exceptions": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "penalty_summary": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "substitute_notice": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "credit_bureau_text": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "risk_of_harm_text": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "glba_deemed_compliance": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf", "private_right_of_action": "https://www.amp.legal/pdf/Puerto_Rico_Breach_Law.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "Guam", "code": "GU", "citation": "9 GCA §§ 48.10-48.80 (added by P.L. 30-004, 2009)", "citation_url": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "consumer_deadline": "Without unreasonable delay", "consumer_deadline_type": "without_unreasonable_delay", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Without unreasonable delay (law-enforcement delay and scope/restore measures allowed) (§ 48.30(a),(d))", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "None", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "Yes", "risk_of_harm_text": "Yes - built into breach definition (identity theft or other fraud caused or reasonably believed)", "glba_deemed_compliance": "Yes - FIs complying with the Federal Interagency Guidance; entities complying with their primary/functional federal regulator (§ 48.40(b))", "special_notes": "AG has exclusive enforcement (actual damages or civil penalty up to $150,000 per breach or series of similar breaches).", "verify_with_counsel": "Verify with counsel: Statute text from the Guam Compiler of Laws chapter dated 2009; later amendments not checked.", "source_type": "official", "source_note": "", "field_sources": { "citation": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "consumer_deadline_text": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "regulator_required_text": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "regulator_timing_text": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "pi_definition_summary": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "breach_definition": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "exceptions": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "penalty_summary": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "substitute_notice": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "credit_bureau_text": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "risk_of_harm_text": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "glba_deemed_compliance": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf", "private_right_of_action": "https://col.guamcourts.gov/sites/default/files/9gc048.pdf" }, "last_verified": "2026-09-30" }, { "jurisdiction": "U.S. Virgin Islands", "code": "VI", "citation": "14 V.I.C. §§ 2208 (agencies), 2209 (persons/businesses), 2210-2212 (Act 6789, 2005)", "citation_url": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "consumer_deadline": "Most expedient time possible", "consumer_deadline_type": "most_expedient", "consumer_days": null, "consumer_day_basis": null, "consumer_deadline_text": "Most expedient time possible and without unreasonable delay (law-enforcement delay and scope/restore measures allowed) (§ 2209(a))", "consumer_clock_start": "No fixed day count", "regulator_recipients": "None", "regulator_threshold_label": "No regulator notice", "regulator_required": "none", "regulator_threshold": null, "threshold_operator": null, "regulator_required_text": "None", "regulator_timing": "none", "regulator_timing_group": "No regulator notice", "regulator_timing_short": "No regulator notice", "regulator_timing_text": "N/A", "credit_bureau_label": "None", "credit_bureau_required": "none", "credit_bureau_threshold": null, "credit_bureau_operator": null, "credit_bureau_text": "None", "risk_of_harm": "No", "risk_of_harm_text": "No", "glba_deemed_compliance": "No GLBA exemption; own-policy deemed compliance only (§ 2209(h))", "special_notes": "Customers injured by a violation may sue for damages (14 V.I.C. 2211).", "verify_with_counsel": "Verify with counsel: Statute text from a code mirror (official/Justia text blocked); amendments not checked.", "source_type": "mirror", "source_note": "", "field_sources": { "citation": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "consumer_deadline_text": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "regulator_required_text": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "regulator_timing_text": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "pi_definition_summary": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "breach_definition": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "exceptions": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "penalty_summary": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "substitute_notice": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "credit_bureau_text": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "risk_of_harm_text": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "glba_deemed_compliance": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/", "private_right_of_action": "https://www.cliclaw.com/library/virgin-islands-notices-security-breach-14-vic-%C2%A7-2201-%C2%A7-2208-%C2%A7-2209/" }, "last_verified": "2026-09-30" } ] }