Data Breach Notification Laws by State: 2026 Table

State breach notification laws: the table

51 jurisdictions (50 states and DC). Each row was read from the statute text (on the state's code site or a published copy of the code) and checked a second time by a different reviewer on October 13, 2026. Select a state for the full rule and the statute link.

Find a state

Data breach notification requirements by state, October 2026
		Notice to the state	Credit bureau notice	No-harm exception	Encrypted data exempt	Also covers
Alabama	45 days	Attorney General: more than 1,000	More than 1,000	Yes	Yes	Health Logins
Alaska	No fixed deadline	Only before skipping notice	More than 1,000	Yes	Yes	Basic set
Arizona	45 days	AG and Arizona DHS: more than 1,000	More than 1,000	Yes	Yes	Health Biometric Logins
Arkansas	No fixed deadline	Attorney General: more than 1,000	Not required	Yes	Yes	Health Biometric
California	30 days	Attorney General: more than 500	Not required	No	Yes	Health Biometric Logins
Colorado	30 days	Attorney General: 500 or more	More than 1,000	Yes	Yes	Health Biometric Logins
Connecticut	60 days	Attorney General: any breach	Not required	Yes	Yes	Health Biometric Logins
Delaware	60 days	Attorney General: more than 500	Not required	Yes	Yes	Health Biometric Logins
District of Columbia	No fixed deadline	DC Attorney General: 50 or more	More than 1,000	Yes	Yes	Health Biometric Logins
Florida	30 days	Dept. of Legal Affairs (AG): 500 or more	More than 1,000	Yes	Yes	Health Biometric Logins
Georgia Narrow scope	No fixed deadline	Not required	More than 10,000	No	Yes	Basic set
Hawaii	No fixed deadline	Office of Consumer Protection: more than 1,000	More than 1,000	Yes	Yes	Basic set
Idaho	No fixed deadline	Not required	Not required	Yes	Yes	Basic set
Illinois	No fixed deadline	Attorney General: more than 500	Not required	No	Yes	Health Biometric Logins
Indiana	45 days	Attorney General: any breach	More than 1,000	Yes	Yes	Basic set
Iowa	No fixed deadline	AG Consumer Protection Division: more than 500	Not required	Yes	Yes	Biometric
Kansas	No fixed deadline	Not required	More than 1,000	Yes	Yes	Basic set
Kentucky	No fixed deadline	Not required	More than 1,000	Yes	Yes	Basic set
Louisiana	60 days	AG (under an AG rule): any breach	Not required	Yes	Yes	Biometric
Maine	30 days	State regulator or AG: any breach	More than 1,000	Yes	Yes	Basic set
Maryland	45 days	Attorney General: any breach	1,000 or more	Yes	Yes	Health Biometric Logins
Massachusetts	No fixed deadline	AG and OCABR: any breach	Not required	No	Yes	Basic set
Michigan	No fixed deadline	Not required	More than 1,000	Yes	Yes	Basic set
Minnesota	No fixed deadline	Not required	More than 500	No	Yes	Basic set
Mississippi	No fixed deadline	Not required	Not required	Yes	Yes	Basic set
Missouri	No fixed deadline	Attorney General: more than 1,000	More than 1,000	Yes	Yes	Health
Montana	No fixed deadline	AG Office of Consumer Protection: any breach	Not required	Yes	Yes	Health
Nebraska	No fixed deadline	Attorney General: any breach	Not required	Yes	Yes	Biometric Logins
Nevada	No fixed deadline	Not required	More than 1,000	No	Yes	Health Logins
New Hampshire	No fixed deadline	AG or primary regulator: any breach	More than 1,000	Yes	Yes	Basic set
New Jersey	No fixed deadline	State Police: any breach	More than 1,000	Yes	Yes	Logins
New Mexico	45 days	Attorney General: more than 1,000	More than 1,000	Yes	Yes	Biometric
New York	30 days	AG, Dept. of State, State Police: any breach	More than 5,000	Limited	Yes	Health Biometric Logins
North Carolina	No fixed deadline	AG Consumer Protection Division: any breach	More than 1,000	Yes	Yes	Biometric
North Dakota	No fixed deadline	Attorney General: more than 250	Not required	No	Yes	Health
Ohio	45 days	Not required	More than 1,000	Yes	Yes	Basic set
Oklahoma	No fixed deadline	Attorney General: 500 or more	Not required	Yes	Yes	Biometric
Oregon	45 days	Attorney General: more than 250	More than 1,000	Yes	Yes	Health Biometric Logins
Pennsylvania	No fixed deadline	Attorney General: more than 500	More than 500	Yes	Yes	Health Logins
Rhode Island	45 days	Attorney General: more than 500	More than 500	Yes	Yes	Health Logins
South Carolina	No fixed deadline	Dept. of Consumer Affairs: more than 1,000	More than 1,000	Yes	Yes	Basic set
South Dakota	60 days	Attorney General: more than 250	Any notice event	Yes	Yes	Health Logins
Tennessee	45 days	Not required	More than 1,000	No	Yes	Basic set
Texas	60 days	Attorney General: 250 or more	More than 10,000	No	Yes	Health
Utah	No fixed deadline	AG and Utah Cyber Center: 500 or more	1,000 or more	Yes	Yes	Basic set
Vermont	45 days	AG or Dept. of Financial Regulation: any breach	More than 1,000	Yes	Yes	Health Biometric Logins
Virginia	No fixed deadline	Attorney General: any breach	More than 1,000	Yes	Yes	Basic set
Washington	30 days	Attorney General: more than 500	Not required	Yes	Yes	Health Biometric Logins
West Virginia	No fixed deadline	Not required	More than 1,000	Yes	Yes	Basic set
Wisconsin	45 days	Not required	1,000 or more	Yes	Yes	Biometric
Wyoming	No fixed deadline	Not required	Not required	Yes	Redacted data only	Health Biometric Logins

51 shown. "Notice to the state" counts are residents affected or notified, as each statute words it. "Also covers" flags health, biometric and online login data beyond the basic set (name plus Social Security, driver's license or financial account number).

Cite or reuse this data

Clear IT Pricing, "Data Breach Notification Laws by State," updated October 13, 2026, https://clearitpricing.com/data-breach-notification-laws-by-state/

Free to reuse with credit and a link to this page (CC BY 4.0).

Download CSV

Need help with a breach or a security plan? Two short steps, free for businesses.

Get a quote for my business

Data breach notification law: A data breach notification law is a state statute that requires a business to tell affected residents, and in many states the attorney general and the credit bureaus, when their unencrypted personal information is acquired by someone without authorization.

How state breach notification laws work

A state breach law applies when someone without permission acquires a resident's unencrypted personal information. In every state that means at least a name together with a Social Security number, a driver's license number, or a financial account or card number with the code needed to use it. Many states now add more: 22 cover medical information, 22 cover biometric data and 21 cover usernames and passwords for online accounts.

Three points trip up many businesses:

Each law protects that state's residents. A breach that exposes customers or employees in five states triggers five laws, each with its own deadline and its own notice to the state. Your company's home state does not decide it.
The business that owns the data notifies. A vendor or IT provider that only stores or processes the data must tell its client quickly, and the client notifies the people affected. Contracts with your managed IT provider should say how fast they will tell you.
Paper and small breaches can count. A few states, including Alaska, Hawaii, North Carolina and Rhode Island, also cover paper records. Most laws have no minimum number of people for the resident notice itself.

The table shows the general law for private businesses. Insurers, banks, health care entities and public companies usually have extra rules on top, covered in the federal section below.

Notification deadlines: 30, 45 or 60 days, or without unreasonable delay

22 states set a fixed outer limit for notifying residents. The other 29 laws say "the most expedient time possible and without unreasonable delay" or similar, with no number of days.

Deadline	States
30 days	California, Colorado, Florida, Maine, New York, Washington
45 days	Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, Wisconsin
60 days	Connecticut, Delaware, Louisiana, South Dakota, Texas

Two of the 30-day rules are new. California set a 30 calendar day deadline that took effect January 1, 2026, and New York added a 30-day limit in December 2024 (see the California and New York rows).

When the clock starts differs. Some states count from discovery of the breach, others from the date the business determines a breach occurred, and several allow a delay at law enforcement's request. "Without unreasonable delay" is not a free pass: a slow response after the facts are known can still be challenged by the attorney general. If a breach touches several states, plan to the shortest deadline that applies, which is often 30 days.

Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.

Get a quote for my business

When you must also notify the attorney general

37 of the 51 laws require notice to the attorney general or another state agency in at least some breaches. 14 require it for any breach that triggers resident notice: Connecticut, Indiana, Louisiana, Maine, Maryland, Massachusetts, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Vermont and Virginia. The rest use a count of affected residents:

50 or more: District of Columbia
250: North Dakota, Oregon and South Dakota (more than 250), Texas (at least 250)
500: eleven states, including California and Illinois (more than 500) and Colorado, Florida and Oklahoma (500 or more)
1,000: seven states, including Alabama, Arizona, Missouri and South Carolina (more than 1,000)

Timing varies more than the counts. Maryland wants the attorney general told before residents. New Jersey wants the State Police told before residents. Texas requires an online report within 30 days of determining the breach, California a sample notice within 15 days of notifying residents, and Vermont a preliminary notice within 14 business days.

Alaska is the odd one out. It has no count-based notice, but a business that decides not to notify residents must first tell the attorney general in writing. Thirteen states require no state notice at all, among them Georgia, Kentucky, Michigan, Ohio and Wisconsin.

Exceptions: no-harm decisions and encryption

41 laws let a business skip notice if it decides, usually after an investigation, that misuse or harm is not reasonably likely. Eleven of them require that decision to be written down and kept, for five years in most of those (Florida and Oregon, for example) and three in Maryland and South Dakota. A few bring the state in: Alaska and South Dakota want the attorney general told before the decision, DC requires consulting the attorney general, and Florida and Vermont want the decision sent to the state. Nine laws have no such exception: California, Georgia, Illinois, Massachusetts, Minnesota, Nevada, North Dakota, Tennessee and Texas. New York allows it only for an inadvertent disclosure by people who were allowed to see the data, and the written decision must be kept for five years.

Encryption is the other way out. 50 of the 51 laws exempt encrypted data unless the key was also taken or the person who took it can read it. Wyoming's law exempts redacted data only and does not mention encryption. In practice, full-disk encryption on laptops and encrypted backups are among the cheapest breach-law protections a small business can buy. Our cyber insurance requirements guide covers the other controls insurers ask about.

A no-harm decision is a legal judgment with consequences if it is wrong. Make it with counsel, and with the forensic findings in hand, not before.

Changes in 2024, 2025 and 2026

Twelve of the 51 rows record a change since the start of 2024, some of them wording fixes or changes to related laws. The ones that change what a business must do:

California (SB 446, effective January 1, 2026): 30 calendar days to notify residents, and a 15-day deadline for the sample notice the attorney general already received when more than 500 residents are notified.
New York (laws of 2024 and 2025, in force from December 2024 and March 2025): a 30-day deadline, medical and health insurance information added, and notice to the Department of Financial Services for DFS-regulated businesses.
Florida (SB 262, effective July 1, 2024): biometric data and geolocation information added to the data the law covers.
Pennsylvania (Act 33 of 2024, effective September 26, 2024): attorney general notice when more than 500 Pennsylvanians are notified, the credit bureau trigger lowered from more than 1,000 to more than 500, plus a credit report and credit monitoring in some breaches.
Oklahoma (SB 626, effective January 1, 2026): attorney general notice for breaches affecting 500 or more residents, and penalties tied to whether reasonable safeguards were in place.
Delaware (HB 381, signed September 2, 2026): a 60-day attorney general notice when affected residents cannot be identified in time. It also narrows the HIPAA and GLBA safe harbor, so those businesses still owe the attorney general notice.
District of Columbia (D.C. Law 26-187, effective September 26, 2026): civil penalties for breach law violations are now mandatory, with set minimums.
Vermont (Act 138 of 2026): enacted but not in force until January 1, 2027. It adds a breach rule for data brokers.

Each row's "Recent change" line has the details and the bill number. We recheck the table when state sessions end and update the date at the top of the page.

Federal rules that apply on top of state law

State law is the floor. These federal rules add their own deadlines for the businesses they cover:

HIPAA (health care providers, plans and their business associates): notify individuals without unreasonable delay and within 60 calendar days of discovery ². Breaches of 500 or more people go to HHS at the same time, and breaches of more than 500 residents of a state also require notice to local media ²³. See our HIPAA compliance services guide and HIPAA checklist.
FTC Safeguards Rule (non-bank financial businesses such as tax preparers, mortgage brokers and auto dealers): notify the FTC within 30 days of discovering a breach of unencrypted information about at least 500 consumers ⁴. The rule also requires a written information security plan.
SEC Regulation S-P (broker-dealers, investment advisers and other covered institutions): notify affected individuals within 30 days of becoming aware of unauthorized access to sensitive customer information ⁵.

Many state laws treat a business that follows its federal rule as compliant with the state rule, but not all do, and several (Delaware, for example) still require the state attorney general notice. Our pages for healthcare and financial services cover the sector rules in more detail.

What to do in the first days after a breach

If a breach is happening now, call your cyber insurer's breach hotline first if you have a policy, report it to the FBI at ic3.gov, and do not wipe or rebuild systems until evidence is preserved ⁶⁷⁸. Insurers often require you to use their approved lawyers and forensic firms, and acting before you call them can put coverage at risk.

Then, in order:

Bring in breach counsel and a forensic firm through the insurer, or directly if you have no policy. Our incident response guide explains what each does.
Work out what data was taken and where the affected people live. That list decides which rows of this table apply.
Put the shortest applicable deadline on a calendar, and note any state that wants the attorney general or another agency told before residents.
Draft notices with counsel. Several states set required contents, and some require an offer of credit monitoring.
Fix the cause. A cybersecurity risk assessment after the incident shows insurers and regulators what changed.

If you do not have an incident response provider yet, our cybersecurity guide for small businesses covers what to put in place before you need it.

The first steps after a data breach

Right nowContain and call
- Call your cyber insurer's breach hotline, if you have a policy⁶
- Report it to the FBI at ic3.gov⁷
- Do not wipe or rebuild systems until evidence is preserved⁸
First daysFind out what happened
- Bring in breach counsel and a forensic firm, through the insurer if you have one
- Work out what data was taken
- List where the affected people live: that decides which state laws apply
The deadlinesNotify on time
- State laws: 30, 45 or 60 days in 22 states, "without unreasonable delay" in the rest (see the state breach law table below)
- HIPAA: individuals within 60 days of discovery²
- FTC Safeguards Rule: the FTC within 30 days if 500 or more consumers are affected⁴
AfterFix the cause
- Close the gap that let the attacker in
- Run a risk assessment and keep the records
- Update your incident response plan

A general order of steps, not legal advice. Your insurer and breach counsel set the exact sequence for your case.

How we built this table

We read each state's breach notification statute on the official legislature or code website, or on a published copy of the code when the official site could not be loaded, and recorded the rule for private businesses. A second reviewer who did not write the row then checked every field against the statute text and searched for 2024 to 2026 amendments. Law firm charts were used only to cross-check, and where a chart disagreed with the statute, the statute won (for example, Colorado's attorney general threshold is 500 or more residents, not more than 500).

What the table leaves out: private rights to sue, which are often unclear from the statute alone; sector rules such as state insurance data security laws; Puerto Rico, Guam and the US Virgin Islands; and contract duties you may owe customers. It is a summary of each statute, not legal advice.

Found something out of date? Email [email protected] with the state and the source, and we will check it and update the row.

Each state's rule in full

Plain-English summaries of each statute. They are not legal advice: confirm your obligations with counsel, and check sector rules (HIPAA, GLBA, state insurance laws) that may also apply.

Alabama data breach notification law 45 days

Notify residents: Within 45 days after the business determines a breach occurred that is reasonably likely to cause substantial harm, or after a third-party agent notifies it of a breach. Notice must go out as fast as possible and without unreasonable delay.
Notify the state: Notify the Attorney General in writing if the number of residents the business must notify exceeds 1,000. Notice is due as fast as possible and without unreasonable delay, within 45 days.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required only if the breach is reasonably likely to cause substantial harm to the people the data relates to. A business that decides not to notify must document the decision in writing and keep the records for at least five years.
Encryption: Truncated, encrypted, secured or unusable data is exempt, unless the business knows or has reason to know the encryption key or security credential was also breached.
Data covered beyond the basic set: Taxpayer ID, passport number, military ID, medical information, health insurance information, online account credentials.
Enforcement: A violation is an unlawful trade practice under the Alabama Deceptive Trade Practices Act, not a crime. Only the Attorney General may seek civil penalties: up to $500,000 per breach for knowing violations, plus up to $5,000 for each day the business fails to take reasonable action to comply.
Also know: Covers electronic data only. A third-party agent that maintains data for a business must tell the business without unreasonable delay and no later than 10 days after determining a breach. Law enforcement can ask for a delay. The law also requires reasonable security measures and secure disposal of records.

Law: Ala. Code §§ 8-38-1 to 8-38-12 | Ala. Code § 8-38-5 | Ala. Code § 8-38-6 and § 8-38-7. Checked October 13, 2026. Back to the table

Alaska data breach notification law No fixed deadline

Notify residents: In the most expeditious time possible and without unreasonable delay after discovering or being notified of the breach. The business may allow time for law enforcement needs, to determine the scope of the breach and to restore the system.
Notify the state: Required only when the business decides not to notify residents. It may skip resident notice only after an appropriate investigation and written notice to the Attorney General that there is not a reasonable likelihood of harm. There is no count-based AG notice.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is required if, after an appropriate investigation and written notice to the Attorney General, the business determines there is not a reasonable likelihood of harm to consumers. The decision must be documented in writing and kept for five years.
Encryption: Encrypted or redacted data is exempt unless the encryption key was also accessed or acquired.
Data covered beyond the basic set: Account number alone, passwords or access codes for financial accounts.
Enforcement: A violation by a business is an unfair or deceptive act under the Alaska Unfair Trade Practices Act. The civil penalty is up to $500 for each resident not notified, capped at $50,000, and damages are limited to actual economic damages.
Also know: Covers personal information in any form, including paper records. An account, credit or debit card number counts on its own, unless the account can only be accessed with a code. Then the number plus the code counts. Businesses subject to the Gramm-Leach-Bliley Act do not have to notify consumer reporting agencies. A business that receives data from another must tell the source immediately after discovering a breach.

Law: Alaska Stat. §§ 45.48.010 to 45.48.090 | AS 45.48.010 | AS 45.48.040. Checked October 13, 2026. Back to the table

Arizona data breach notification law 45 days

Notify residents: Within 45 days after determining a breach occurred. If law enforcement asks for a delay, the 45 days start when law enforcement says notice will no longer compromise the investigation.
Notify the state: Notify the Attorney General and the Director of the Arizona Department of Homeland Security in writing within 45 days after determining the breach, if the breach requires notice to more than 1,000 individuals.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if the business, an independent third-party forensic auditor or a law enforcement agency finds after a reasonable investigation that the breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals. No documentation or AG notice is required.
Encryption: Only unencrypted and unredacted data is covered. The statute has no separate exception for a stolen key.
Data covered beyond the basic set: Online account credentials, digital signature, health insurance information, medical information, passport number, taxpayer ID, biometric data.
Enforcement: Only the Attorney General may enforce, and only for knowing and willful violations. The civil penalty may not exceed the lesser of $10,000 per affected individual or the total economic loss, with a cap of $500,000 for a breach or series of related breaches. The AG may also seek restitution.
Also know: A business must promptly investigate any security incident. A vendor that maintains data must notify the owner as soon as practicable after discovering a breach. Businesses covered by HIPAA or the Gramm-Leach-Bliley Act are exempt. Taxpayer ID includes an IRS identity protection PIN. The Department of Homeland Security notice was added in 2022.

Law: Ariz. Rev. Stat. §§ 18-551 to 18-552 | A.R.S. 18-551 definitions. Checked October 13, 2026. Back to the table

Arkansas data breach notification law No fixed deadline

Notify residents: In the most expedient time and manner possible and without unreasonable delay. The business may allow for law enforcement needs and steps to determine the scope of the breach and restore the system.
Notify the state: Notify the Attorney General if a breach affects the personal information of more than 1,000 individuals. Notice is due at the same time as notice to individuals, or within 45 days after determining there is a reasonable likelihood of harm, whichever comes first.
Credit bureaus: Not required.
No-harm exception: No notice is required if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers. It must keep the written determination and supporting documents for five years and give them to the AG within 30 days of a written request.
Encryption: Data counts only when the name or the data element is not encrypted or redacted. The statute has no express exception for a stolen key.
Data covered beyond the basic set: Medical information, biometric data, genetic data.
Enforcement: The Attorney General enforces violations under the Arkansas Deceptive Trade Practices Act. The breach statute sets no separate penalty amount.
Also know: Covers computerized data. A vendor that maintains data must notify the owner immediately after discovering a breach. Biometric data includes fingerprints, faceprints, retina or iris scans, voiceprints and DNA. Insurance licensees have a separate rule under the insurance code. Last amended by Act 1030 of 2019, with no amendments from 2024 to 2026.

Law: Ark. Code Ann. §§ 4-110-101 to 4-110-108 | Ark. Code Ann. § 4-110-108. Checked October 13, 2026. Back to the table

California data breach notification law 30 days

Notify residents: Within 30 calendar days of discovering or being notified of the breach. The business may delay for the legitimate needs of law enforcement or as needed to determine the scope of the breach and restore the system.
Notify the state: Submit one sample copy of the notice, without personal information, to the Attorney General electronically within 15 calendar days of notifying consumers. This applies when a single breach requires notice to more than 500 California residents.
Credit bureaus: Not required.
No-harm exception: No risk of harm exception. Notice is required for any breach of covered unencrypted data.
Encryption: Encrypted data is exempt unless the encryption key or security credential was, or is reasonably believed to have been, acquired and the business reasonably believes it could make the data readable.
Data covered beyond the basic set: Taxpayer ID, passport number, military ID, medical information, health insurance information, biometric data, genetic data, automated license plate recognition data, online account credentials.
Enforcement: Any customer injured by a violation may sue to recover damages. A business that violates the law may also be enjoined.
Recent change: SB 446 (Stats. 2025, ch. 319), signed October 3, 2025 and effective January 1, 2026, set the 30 calendar day deadline for residents and the 15 calendar day deadline for the AG sample notice.
Also know: Notices need the title 'Notice of Data Breach'. A business that was the source of a breach of Social Security, driver's license or California ID numbers must offer free identity theft prevention and mitigation for at least 12 months. Vendors must notify the owner immediately. The CCPA (Civ. Code § 1798.150) lets consumers sue for statutory damages over certain breaches caused by a lack of reasonable security. Health facilities follow a 15 business day rule (Health and Safety Code § 1280.15).

Law: Cal. Civ. Code §§ 1798.80 to 1798.84 (notice rule at § 1798.82) | SB 446 amending Civ. Code § 1798.82 | CA SB446, 2025-2026 Regular Session, bill history. Checked October 13, 2026. Back to the table

Colorado data breach notification law 30 days

Notify residents: No later than 30 days after determining a breach occurred, in the most expedient time possible and without unreasonable delay. If another state or federal rule that applies to the business sets a shorter deadline, the shorter one controls.
Notify the state: Notify the Attorney General no later than 30 days after determining a breach occurred, if it is reasonably believed to have affected 500 Colorado residents or more. This does not apply if the investigation finds misuse has not occurred and is not likely to occur.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if a good faith, prompt investigation finds that misuse of the information has not occurred and is not reasonably likely to occur. No documentation or AG notice is required.
Encryption: Encrypted data is exempt unless the confidential process, encryption key or other means to decipher it was also acquired or reasonably believed to have been acquired.
Data covered beyond the basic set: Employer ID or student ID, military ID, passport number, medical information, health insurance information, biometric data, online account credentials.
Enforcement: The Attorney General may sue in law or equity for appropriate relief or to recover direct economic damages. The statute sets no separate penalty amount.
Also know: Covers computerized data. A third-party service provider must notify the business and cooperate in a breach. Businesses subject to the Gramm-Leach-Bliley Act do not have to notify consumer reporting agencies. The law also requires reasonable security and a written disposal policy. Last amended in 2018 (HB 18-1128).

Law: Colo. Rev. Stat. § 6-1-716 | Data Protection. Checked October 13, 2026. Back to the table

Connecticut data breach notification law 60 days

Notify residents: No later than 60 days after discovering the breach, and without unreasonable delay, unless federal law requires a shorter time. Residents identified after the 60 days must be notified as fast as possible.
Notify the state: Notify the Attorney General of any breach that requires notice to residents, no later than when residents are notified.
Credit bureaus: Not required.
No-harm exception: No notice is needed if, after an appropriate investigation, the business reasonably determines the breach will not likely result in harm to the people whose information was acquired or accessed. No documentation or AG notice is required.
Encryption: A breach covers access to personal information not secured by encryption or another method that makes it unreadable or unusable. The statute does not mention a stolen key.
Data covered beyond the basic set: Taxpayer ID, passport number, military ID, credit or debit card number alone, medical information, health insurance information, biometric data, precise geolocation, online account credentials.
Enforcement: Failure to comply is an unfair trade practice under the Connecticut Unfair Trade Practices Act, enforced by the Attorney General. The breach statute sets no separate penalty amount.
Also know: If Social Security or taxpayer ID numbers are involved, the business must offer free identity theft prevention services, and mitigation services if applicable, for at least 24 months. A vendor that maintains data must notify the owner immediately after discovery. Taxpayer ID includes an IRS identity protection PIN. A credit or debit card number counts even without a code. Precise geolocation was added by P.A. 23-98 in 2023.

Law: Conn. Gen. Stat. § 36a-701b | Conn. Gen. Stat. § 36a-701b(b)(1). Checked October 13, 2026. Back to the table

Delaware data breach notification law 60 days

Notify residents: No later than 60 days after determining the breach, and without unreasonable delay, unless federal law requires less time or law enforcement asks for a delay. Residents not identified within 60 days must be notified as soon as practicable once identified.
Notify the state: Notify the Attorney General no later than when residents are notified, if the number of Delaware residents to be notified exceeds 500. If affected residents cannot be identified within 60 days, notify the AG within 60 days of determining the breach, unless substitute notice is given in that time.
Credit bureaus: Not required.
No-harm exception: No notice is needed if, after an appropriate investigation, the business reasonably determines the breach is unlikely to result in harm to the individuals. No documentation or AG notice is required.
Encryption: Acquiring encrypted data is not a breach unless the acquisition includes, or is reasonably believed to include, the encryption key and the owner reasonably believes the key could make the data readable.
Data covered beyond the basic set: Passport number, online account credentials, medical information, genetic data, health insurance information, biometric data, taxpayer ID.
Enforcement: The Attorney General may sue in law or equity to address violations and recover direct economic damages. The statute sets no separate penalty amount and preserves any other rights a person has by law.
Recent change: HB 381 (85 Del. Laws c. 464), signed September 2, 2026 and effective on signing, requires Attorney General notice within 60 days when affected residents cannot be identified in that time. It also limits the HIPAA and Gramm-Leach-Bliley safe harbor to the timing rules in § 12B-102(c).
Also know: If Social Security numbers are breached, the business must offer one year of free credit monitoring unless it determines harm is unlikely. Covers computerized data. Vendors must notify the owner immediately after determining a breach. HIPAA and GLBA businesses following their own breach procedures are deemed compliant only with the § 12B-102(c) timing rules, including the 60 day AG notice, not with the more than 500 AG notice or credit monitoring.

Law: Del. Code Ann. tit. 6, §§ 12B-100 to 12B-104. Checked October 13, 2026. Back to the table

District of Columbia data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay. The business may allow for law enforcement needs and steps to determine the scope of the breach and restore the system.
Notify the state: Give written notice to the Office of the Attorney General if the breach affects 50 or more District residents. It is due promptly and no later than when residents are notified. Not knowing the number of affected residents does not delay this notice.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: An acquisition is not a breach if the business reasonably determines it will likely not result in harm to the individual. This requires a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement agencies.
Encryption: Encrypted or redacted data is exempt unless the information acquired could compromise the security protection, such as a key.
Data covered beyond the basic set: Taxpayer ID, passport number, military ID, medical information, genetic data, health insurance information, biometric data, online account credentials.
Enforcement: A violation is an unfair or deceptive trade practice under the D.C. Consumer Protection Procedures Act. In an AG action, the AG shall recover a civil penalty of $500 to $5,000 per violation, or $1,000 to $10,000 per repeat violation. Consumers may recover actual damages.
Recent change: D.C. Law 26-187, the Enhancing Consumer Protection Procedures Amendment Act of 2026 (effective September 26, 2026), made AG civil penalties for breach violations mandatory, with $500 and $1,000 minimums, and moved them to § 28-3904(b)(14). Its rewrite of § 28-3905 applies only once funded in an approved budget.
Also know: If Social Security or taxpayer ID numbers are released, the business must offer free identity theft protection for at least 18 months (§ 28-3852.02). The AG notice must include set details, such as the number of residents affected and a sample of the notice. A vendor that maintains data must notify the owner in the most expedient time possible after discovery. The law also requires reasonable security (§ 28-3852.01). Credentials that give access to an email account count.

Law: D.C. Code §§ 28-3851 to 28-3853 | § 28-3851(1)(B)(iii) | § 28-3853(b). Checked October 13, 2026. Back to the table

Florida data breach notification law 30 days

Notify residents: No later than 30 days after determining a breach occurred or having reason to believe one occurred, as fast as practicable and without unreasonable delay. A business can get 15 more days by giving the Department of Legal Affairs good cause in writing within the 30 days.
Notify the state: Notify the Department of Legal Affairs of any breach affecting 500 or more individuals in Florida. Notice is due as fast as practicable and no later than 30 days after determining the breach or having reason to believe one occurred.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if, after an appropriate investigation and consulting law enforcement, the business reasonably determines the breach has not and will not likely cause identity theft or other financial harm. Keep the written decision at least 5 years and send it to the Department of Legal Affairs within 30 days.
Encryption: Information that is encrypted, secured, or modified so it no longer identifies a person or is otherwise unusable is not personal information. The statute has no separate key exception.
Data covered beyond the basic set: Online account credentials, passport number, military ID, medical information, health insurance information, biometric data, geolocation information.
Enforcement: The Department of Legal Affairs enforces violations as an unfair or deceptive trade practice. The civil penalty for failing to notify is $1,000 a day for the first 30 days, then $50,000 for each later 30 day period up to 180 days, and up to $500,000 past 180 days. It is counted per breach, not per person.
Recent change: SB 262 (ch. 2023-201) added biometric data and any geolocation information to personal information, effective July 1, 2024. SB 7026 (ch. 2026-52, effective April 23, 2026) changed only the public records wording on proprietary information in subsection (11), not the notice rules.
Also know: Covers sole proprietors, partnerships, corporations and other commercial entities that acquire, keep, store or use personal information in electronic form. Vendors must tell the business within 10 days of determining a breach. A vendor's failure to send notices it agreed to send is the business's violation. Notice under a primary federal regulator's rules complies if a copy goes to the Department. Reasonable security and proper disposal are also required.

Law: Fla. Stat. § 501.171 | 2026 Florida Statutes § 501.171 (history note). Checked October 13, 2026. Back to the table

Georgia data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach. The business may allow for law enforcement needs and steps to find the scope of the breach and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 10,000 residents notified.
No-harm exception: No risk of harm exception. Notice is required when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Encryption: Data counts as personal information only when the name or the data elements are not encrypted or redacted. The statute has no key exception.
Data covered beyond the basic set: Account number alone, account passwords, PINs or access codes, data elements without a name if enough to commit identity theft.
Enforcement: The breach statute sets no penalty and names no enforcing agency.
Also know: Narrow law. It covers only information brokers (businesses that, for fees or dues, collect personal information and pass it to nonaffiliated third parties) and state and local government agencies. Most small businesses are not covered. A vendor that keeps data for a covered business must tell that business within 24 hours of discovering a breach. A card or account number counts on its own only if it could be used without added codes or passwords.

Law: Ga. Code Ann. §§ 10-1-910 to 10-1-912 | Ga. Code § 10-1-911 Definitions. Checked October 13, 2026. Back to the table

Hawaii data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after discovering or being notified of the breach. The business may allow time to find contact information, determine the scope of the breach and restore the system.
Notify the state: Notify the Office of Consumer Protection in writing, without unreasonable delay, of the timing, distribution and content of the notice, if the business notifies more than 1,000 persons at one time.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required only if illegal use of the personal information has occurred or is reasonably likely to occur and that creates a risk of harm to a person. Otherwise the event is not a security breach.
Encryption: Encrypted data is exempt unless the confidential process or key was also acquired.
Data covered beyond the basic set: Account number alone.
Enforcement: The Attorney General or the executive director of the Office of Consumer Protection may sue. The penalty is up to $2,500 for each violation.
Also know: Covers personal information in any form, including paper. An account number, card number, access code or password counts on its own if it would permit access to a financial account. Vendors must tell the owner immediately. Financial institutions following federal interagency guidance and HIPAA covered health plans and providers are treated as compliant. Bills SB 3016 and SB 1038 to expand covered data were not enacted in 2026.

Law: Haw. Rev. Stat. §§ 487N-1 to 487N-4 | HRS § 487N-1 Definitions | HRS § 487N-3 Penalties and civil action. Checked October 13, 2026. Back to the table

Idaho data breach notification law No fixed deadline

Notify residents: As soon as possible and without unreasonable delay, once a prompt, good faith investigation finds misuse has occurred or is reasonably likely. The business may allow for law enforcement needs and steps to find the scope of the breach, identify those affected and restore the system.
Notify the state: Private businesses do not have to notify a state agency. Only city, county and state agencies must notify the Attorney General, within 24 hours of discovery.
Credit bureaus: Not required.
No-harm exception: Notice is required only if the investigation finds misuse of residents' information has occurred or is reasonably likely to occur. The finding does not have to be written down or sent to the Attorney General.
Encryption: Only unencrypted data is covered. The statute has no key exception.
Enforcement: The primary regulator, which is the Attorney General for most businesses, may sue to enforce and stop violations. A business that intentionally fails to give notice faces a fine of up to $25,000 per breach.
Also know: Covers individuals and commercial entities, for profit or not, that own or license computerized personal information of Idaho residents. A vendor must notify and cooperate with the owner immediately after discovering a breach if misuse has occurred or is reasonably likely. Businesses that follow their own security policy with consistent timing, or their regulator's breach procedures, are treated as compliant. A 2025 bill (S1066) to add free credit monitoring did not pass.

Law: Idaho Code §§ 28-51-104 to 28-51-107 | Idaho Code § 28-51-107 Violations | Idaho Code § 28-51-104 Definitions. Checked October 13, 2026. Back to the table

Illinois data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach. The business may allow time to find the scope of the breach and restore the system.
Notify the state: Notify the Attorney General no later than when residents are notified, if a single breach requires notice to more than 500 Illinois residents.
Credit bureaus: Not required.
No-harm exception: The statute has no risk of harm exception.
Encryption: Encrypted or redacted data is exempt unless the keys to unencrypt or read it were acquired through the breach.
Data covered beyond the basic set: Online account credentials, medical information, health insurance information, biometric data, account number alone.
Enforcement: A violation is an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act. The breach statute sets no separate penalty amount.
Also know: Covers data collectors, including businesses that handle nonpublic personal information. A vendor must notify the owner immediately and cooperate. The resident notice must not state how many Illinois residents were affected. The AG may publish the business name, data types and breach dates. HIPAA entities that comply with HIPAA are treated as compliant, but if they notify HHS they must also notify the Illinois AG within 5 business days. Reasonable security is required.

Law: 815 ILCS 530/5 to 530/50 (Personal Information Protection Act) | 815 ILCS 530/10 Notice of breach | 815 ILCS 530/5, 530/20, 530/50. Checked October 13, 2026. Back to the table

Indiana data breach notification law 45 days

Notify residents: No more than 45 days after discovering the breach, and without unreasonable delay. Delay is allowed only to restore the system, find the scope of the breach, or at the request of the Attorney General or law enforcement.
Notify the state: Notify the Attorney General whenever a database owner must notify residents, with no minimum number of residents. The 45 day limit in IC 24-4.9-3-3 applies to every disclosure under the chapter.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required if the database owner knows, should know, or should have known that the breach has resulted in or could result in identity deception, identity theft, or fraud affecting the resident.
Encryption: Encrypted or redacted data is exempt unless the encryption key was also acquired. A lost or stolen portable device is not a breach if all data on it is encrypted and the key is secure.
Data covered beyond the basic set: Credit card number alone, Social Security number alone, without a name, age verification information collected by adult website operators.
Enforcement: Only the Attorney General can pursue a violation, which is a deceptive act. The AG may seek an injunction and a civil penalty of up to $150,000 per deceptive act.
Recent change: P.L.98-2024 (Senate Enrolled Act 17), effective July 1, 2024, added information collected by adult oriented website operators for age verification to the definition of personal information.
Also know: Covers database owners that own or license computerized data with Indiana residents' personal information, including computer data later moved to paper or other media. A credit card number counts with a name even without a code. A vendor that keeps data for a database owner must notify the owner if personal information was or may have been acquired. No deadline is set for that.

Law: Ind. Code §§ 24-4.9-1-1 to 24-4.9-4-2 | IC 24-4.9-3-1 Disclosure of breach | IC 24-4.9-4-1 and 4-2 Enforcement. Checked October 13, 2026. Back to the table

Iowa data breach notification law No fixed deadline

Notify residents: In the most expeditious manner possible and without unreasonable delay. The business may allow for law enforcement needs and steps to find contact information, find the scope of the breach and restore the data.
Notify the state: Give written notice to the director of the consumer protection division of the Attorney General's office within five business days after notifying consumers, if a breach requires notice to more than 500 Iowa residents.
Credit bureaus: Not required.
No-harm exception: Notice is not required if, after an appropriate investigation or consultation with law enforcement, the business determines there is no reasonable likelihood of financial harm to the affected consumers. The decision must be documented in writing and kept for five years.
Encryption: Encrypted, redacted, or otherwise unreadable data is exempt unless the keys to read it were obtained through the breach.
Data covered beyond the basic set: Biometric data, other government-issued ID number, electronic identifier or routing code with access code.
Enforcement: A violation is an unlawful practice under Iowa Code section 714.16, enforced by the Attorney General. The AG may also seek damages on behalf of injured persons.
Also know: Covers any person who owns or licenses computerized personal information used in a business, job or volunteer activity, including data moved from computers to paper or other media. A vendor must notify the owner immediately after discovery. Businesses following GLBA, HIPAA, or a federal regulator's rules with equal or greater protection are exempt. No consumer reporting agency notice is required, but the resident notice must include their contact information.

Law: Iowa Code §§ 715C.1 to 715C.2. Checked October 13, 2026. Back to the table

Kansas data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay, once a prompt, good faith investigation finds misuse has occurred or is reasonably likely.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required only if the investigation finds misuse has occurred or is reasonably likely. A breach is also defined as one that causes, or that the business reasonably believes has caused or will cause, identity theft. No documentation is required.
Encryption: Encrypted or redacted data is exempt. The statute has no key exception.
Data covered beyond the basic set: Account number alone.
Enforcement: The Attorney General may sue in law or equity for violations. The statute sets no penalty amount, and this enforcement section does not apply to insurance companies licensed in Kansas.
Also know: Covers persons that do business in Kansas and own or license computerized personal information. A business that keeps data it does not own must notify the owner after discovering a breach. Businesses that follow their own security policy with consistent timing, or their state or federal regulator's breach procedures, are treated as compliant.

Law: Kan. Stat. Ann. §§ 50-7a01 to 50-7a02 | K.S.A. 50-7a01 Definitions. Checked October 13, 2026. Back to the table

Kentucky data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach. The business may allow for law enforcement needs and steps to find the scope and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: A breach counts only if the acquisition actually causes, or leads the business to reasonably believe it has caused or will cause, identity theft or fraud against a Kentucky resident. No separate documentation rule applies.
Encryption: Only unencrypted and unredacted data is covered. The statute does not address a stolen encryption key.
Enforcement: The statute sets no penalty and names no enforcing agency.
Also know: Businesses subject to the Gramm-Leach-Bliley Act or HIPAA are exempt. A vendor that only maintains the data must tell the data owner as soon as reasonably practicable. A business that follows its own notice policy with consistent timing is treated as compliant.

Law: Ky. Rev. Stat. § 365.732. Checked October 13, 2026. Back to the table

Louisiana data breach notification law 60 days

Notify residents: No later than 60 days after discovering the breach, in the most expedient time possible and without unreasonable delay.
Notify the state: Send the Attorney General written notice, with the names of all Louisiana residents affected, within 10 days of notifying residents. This duty comes from an AG rule (LAC 16:III.701), not the statute. Under the statute, if resident notice is delayed past 60 days, give the AG written reasons within the 60 days.
Credit bureaus: Not required.
No-harm exception: No notice is needed if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to Louisiana residents. It must keep the written determination and supporting documents for five years and send them to the AG within 30 days of a written request.
Encryption: Encrypted or redacted data is not personal information under the statute. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Passport number, biometric data.
Enforcement: A violation is an unfair or deceptive trade practice under the Louisiana Unfair Trade Practices Act (R.S. 51:1405). Individuals may sue for actual damages from a failure to disclose on time. Under the AG rule, late AG notice can bring a fine up to $5,000 per violation, with each day a separate violation.
Also know: The AG has an online form for its notice. The statute also requires reasonable security procedures and secure disposal of personal information. A vendor that only maintains the data must notify the owner, under the same 60-day outer limit. Financial institutions that follow the federal interagency guidance are deemed compliant.

Law: La. Rev. Stat. §§ 51:3071 to 51:3077; La. Admin. Code tit. 16, pt. III, § 701 | RS 51:3073 (definitions) | RS 51:3075 Recovery of damages. Checked October 13, 2026. Back to the table

Maine data breach notification law 30 days

Notify residents: No more than 30 days after the business becomes aware of the breach and identifies its scope, as expediently as possible and without unreasonable delay, unless law enforcement has asked for a delay.
Notify the state: When resident notice is required, notify the appropriate state regulators within the Department of Professional and Financial Regulation. A business not regulated by that department notifies the Attorney General.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required only if a good faith, reasonable and prompt investigation finds misuse of the personal information has occurred or is reasonably possible. Information brokers must notify whenever data was or is reasonably believed to have been acquired by an unauthorized person.
Encryption: Data is covered only when the name or the data elements are not encrypted or redacted. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Account number alone, account passwords, PINs or other access codes.
Enforcement: A violation is a civil violation, enforced by the Department of Professional and Financial Regulation for businesses it regulates and by the Attorney General for all others. Fines are up to $500 per violation and up to $2,500 per day, plus equitable relief or an injunction.
Also know: Data elements count even without a name if they would be enough to let someone assume the person's identity. An account or card number counts on its own if it could be used without a code or password. A law enforcement delay may last no longer than 7 business days after the agency says notice will not compromise the investigation. The AG has an online reporting form.

Law: Me. Rev. Stat. tit. 10, §§ 1346 to 1350-B | 10 M.R.S. § 1347 (definitions) | 10 M.R.S. § 1349. Checked October 13, 2026. Back to the table

Maryland data breach notification law 45 days

Notify residents: As soon as reasonably practicable, but no later than 45 days after the business discovers or is notified of the breach.
Notify the state: Notify the Office of the Attorney General before notifying individuals, including the number of affected Maryland residents. No minimum number of residents applies.
Credit bureaus: 1,000 or more residents notified.
No-harm exception: No notice is needed if a good faith, reasonable and prompt investigation leads the business to reasonably determine the breach does not create a likelihood that personal information has been or will be misused. It must keep records of that determination for 3 years.
Encryption: Data elements are covered only when not encrypted, redacted, or otherwise protected by a method that makes them unreadable or unusable. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Taxpayer ID, passport number, other federal government ID number, medical information, health insurance information, biometric data, genetic data, online account credentials.
Enforcement: A violation is an unfair or deceptive trade practice under the Maryland Consumer Protection Act, with civil penalties up to $10,000 per violation and $25,000 per repeat violation.
Also know: A vendor that only maintains the data must notify the owner no later than 10 days after discovering the breach. Online account credentials means a user name or email address with a password or security question that permits access to an email account. Individuals can sue through the Consumer Protection Act (Com. Law § 13-408), which § 14-3508 makes applicable. The law also requires reasonable security procedures.

Law: Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 | Com. Law § 14-3506 | Com. Law § 14-3501 (definitions). Checked October 13, 2026. Back to the table

Massachusetts data breach notification law No fixed deadline

Notify residents: As soon as practicable and without unreasonable delay after the business knows or has reason to know of the breach. Notice may not be delayed because the total number of affected residents is not yet known.
Notify the state: A business that owns or licenses the data must notify the Attorney General, the Director of Consumer Affairs and Business Regulation and the affected resident as soon as practicable and without unreasonable delay. The report must say whether the business has a written information security program.
Credit bureaus: Not required.
No-harm exception: In practice, none. The breach definition has a substantial risk of identity theft or fraud test, but Section 3(b) separately requires notice whenever the business knows or has reason to know a resident's data was acquired or used by an unauthorized person or for an unauthorized purpose.
Encryption: Data encrypted at 128-bit or higher is exempt unless the confidential process or key was also acquired or used.
Data covered beyond the basic set: Account number alone.
Enforcement: The Attorney General may sue under Chapter 93A, section 4, where the civil penalty is up to $5,000 per violation.
Also know: If Social Security numbers are exposed, the business must offer at least 18 months of free credit monitoring (42 months for consumer reporting agencies) and may not require a waiver of the right to sue. The resident notice may not describe the nature of the breach or the number affected. OCABR tells the business which consumer reporting agencies or state agencies to notify. Vendors must notify the owner. 201 CMR 17.00 requires a written information security program.

Law: Mass. Gen. Laws ch. 93H, §§ 1 to 6 | M.G.L. c. 93H, § 1 (definitions) | M.G.L. c. 93H, § 3A. Checked October 13, 2026. Back to the table

Michigan data breach notification law No fixed deadline

Notify residents: Without unreasonable delay. The business may allow time to find the scope of the breach and restore the system, or for a law enforcement delay.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if the business determines the breach has not caused and is not likely to cause substantial loss or injury to, or identity theft for, any Michigan resident. It must act with the care an ordinarily prudent person would use.
Encryption: Encrypted or redacted data is exempt unless it was acquired by a person with unauthorized access to the encryption key.
Enforcement: The Attorney General or a county prosecutor may seek a civil fine up to $250 for each knowing failure to notify, capped at $750,000 for the same breach. Sending a false breach notice with intent to defraud is a misdemeanor.
Also know: A vendor that only maintains the data must notify the owner. Senate Bills 360 to 364 (2025) would add a 45-day deadline and Attorney General notice. They passed the Senate on August 26, 2025 but have not passed the House, so they are not law.

Law: Mich. Comp. Laws §§ 445.63, 445.72 | 2025 Senate Bill 360 status. Checked October 13, 2026. Back to the table

Minnesota data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay. The business may allow for law enforcement needs and steps to find the scope of the breach and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 500 residents notified.
No-harm exception: No risk of harm exception. Any unauthorized acquisition of covered data that compromises its security, confidentiality or integrity requires notice.
Encryption: Data secured by encryption or another method that makes it unreadable or unusable is exempt unless the key or other means to read it was also acquired.
Enforcement: The Attorney General enforces the law under Minn. Stat. § 8.31, which allows injunctions and civil penalties up to $25,000.
Also know: If more than 500 persons are notified at one time, the business must tell the nationwide consumer reporting agencies within 48 hours. A vendor that only maintains the data must notify the owner immediately. Financial institutions covered by the Gramm-Leach-Bliley Act are exempt. Any waiver of the statute is void.

Law: Minn. Stat. § 325E.61 | Minn. Stat. 8.31. Checked October 13, 2026. Back to the table

Mississippi data breach notification law No fixed deadline

Notify residents: Without unreasonable delay. The business may allow for law enforcement needs and steps to find the scope of the breach and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: Not required.
No-harm exception: No notice is needed if, after an appropriate investigation, the business reasonably determines the breach will not likely result in harm to the affected individuals. No documentation rule applies.
Encryption: A breach covers only personal information not secured by encryption or another method that makes it unreadable or unusable. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Tribal ID number.
Enforcement: Failure to comply is an unfair trade practice enforced by the Attorney General. The section sets no penalty amount of its own.
Also know: A vendor that only maintains the data must notify the owner as soon as practicable. 2026 Senate Bill 2128, which would have required notice to the Attorney General, died in committee on February 3, 2026.

Law: Miss. Code Ann. § 75-24-29 | MS SB2128 (2026). Checked October 13, 2026. Back to the table

Missouri data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after discovering or being notified of the breach. The business may allow for law enforcement needs and steps to find the scope of the breach and restore the system.
Notify the state: Notify the Attorney General's office and all consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notice, if notice goes to more than 1,000 consumers at one time.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if, after an appropriate investigation or consultation with law enforcement, the business determines identity theft or other fraud is not reasonably likely. The determination must be documented in writing and kept for five years.
Encryption: Data elements that are encrypted, redacted, or otherwise made unreadable or unusable are exempt. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Medical information, health insurance information, other government-issued ID number, unique electronic identifier or routing code with access code.
Enforcement: The Attorney General has exclusive authority to sue for actual damages for a willful and knowing violation. The AG may also seek a civil penalty up to $150,000 per breach or series of similar breaches found in a single investigation.
Also know: A vendor that only maintains the data must notify the owner immediately after discovery. A law enforcement delay request must be in writing or documented. Businesses that follow their own consistent notice policy or their federal or state regulator's procedures are treated as compliant.

Law: Mo. Rev. Stat. § 407.1500. Checked October 13, 2026. Back to the table

Montana data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after discovering or being told of the breach. The business may allow for law enforcement needs and time to find the scope of the breach and restore the system.
Notify the state: Send the Attorney General's consumer protection office an electronic copy of the notice and a statement of the date and method of distribution, at the same time residents are notified. Leave out personal identifying information.
Credit bureaus: Not required.
No-harm exception: A breach counts only if it materially compromises personal information and causes, or is reasonably believed to cause, loss or injury to a Montana resident. No documentation or AG filing rule applies to this decision.
Encryption: Only unencrypted personal information is covered. The statute does not say what happens if the key is also taken.
Data covered beyond the basic set: Medical information, taxpayer ID, IRS identity protection PIN, tribal ID card number.
Enforcement: The Department of Justice may sue for an injunction. A violation is an unfair trade practice under 30-14-103, with a civil fine of up to $10,000 for each willful violation under 30-14-142.
Also know: No credit bureau notice is required, but a notice that tells people they can get a credit report must be coordinated with the credit bureau on timing, content and distribution. A vendor must notify the owner immediately. A business that follows its own notice procedures consistent with this law is treated as compliant. Last amended in 2015. A consumer with a money or property loss can bring an individual, non-class suit under the general consumer protection law (30-14-133).

Law: Mont. Code Ann. §§ 30-14-1701 to 30-14-1705 | MCA 30-14-1705 Department to restrain unlawful acts, penalty | MCA 30-14-142 Penalties. Checked October 13, 2026. Back to the table

Nebraska data breach notification law No fixed deadline

Notify residents: As soon as possible and without unreasonable delay, after a prompt, good faith investigation. The business may allow for law enforcement needs and time to find the scope of the breach and restore the system.
Notify the state: Notify the Attorney General no later than when Nebraska residents are notified, whenever resident notice is required.
Credit bureaus: Not required.
No-harm exception: Notice is required only if the investigation finds use of the information for an unauthorized purpose has occurred or is reasonably likely to occur. The finding does not have to be written down or sent to the AG.
Encryption: Encrypted, redacted or otherwise unreadable data is exempt. Data is not treated as encrypted if the key was, or is reasonably believed to have been, acquired in the breach.
Data covered beyond the basic set: Online account credentials, biometric data, electronic ID number or routing code with access code.
Enforcement: The Attorney General may issue subpoenas and recover direct economic damages for each affected resident injured by a violation. The statute sets no civil penalty amount for the notice rule.
Also know: Login credentials count on their own. A vendor must notify the owner. Section 87-808 requires reasonable security, including in vendor contracts, and makes a violation a Consumer Protection Act violation with no private lawsuit. Last amended in 2016 (notice) and 2018 (security). LB 241 (signed March 17, 2025) bars class actions over cybersecurity events unless the business acted with willful, wanton or gross negligence.

Law: Neb. Rev. Stat. §§ 87-801 to 87-808 | Neb. Rev. Stat. 87-802 | Neb. Rev. Stat. 87-806. Checked October 13, 2026. Back to the table

Nevada data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay after discovering or being told of the breach. The business may allow for law enforcement needs and time to find the scope of the breach and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No risk of harm exception. A breach is an unauthorized acquisition that materially compromises the security, confidentiality or integrity of personal information.
Encryption: Only unencrypted personal information is covered. The statute does not say what happens if the key is also taken.
Data covered beyond the basic set: Online account credentials, medical ID number, health insurance information.
Enforcement: The Attorney General or a district attorney may sue for an injunction. A violation is a deceptive trade practice under NRS 598.0903 to 598.0999.
Also know: Login credentials count on their own. A vendor must notify the owner immediately. GLBA-compliant businesses are treated as compliant, and installment lenders licensed under NRS 675 are excluded (since 2023). The law also requires reasonable security, PCI DSS compliance for businesses that accept payment cards, and encryption of personal information sent outside the business's secure system. 2025 amendments changed sections 603A.210, 603A.215 and 603A.217, not the notice rule.

Law: Nev. Rev. Stat. §§ 603A.010 to 603A.290 | NRS 603A.260 and 603A.290. Checked October 13, 2026. Back to the table

New Hampshire data breach notification law No fixed deadline

Notify residents: As soon as possible after promptly determining the likelihood of misuse.
Notify the state: Notify the New Hampshire Attorney General's office, with the anticipated date of notice to individuals and the approximate number of individuals in the state who will be notified. Businesses subject to RSA 358-A:3, I notify their primary regulator instead.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required if misuse has occurred or is reasonably likely to occur, or if a determination cannot be made. The business has the burden of showing it complied. The finding does not have to be filed with the AG.
Encryption: Encrypted data is exempt, but not if it was acquired together with any key, security code, access code or password needed to read it.
Data covered beyond the basic set: Government ID number.
Enforcement: The Attorney General enforces the law under the Consumer Protection Act (RSA 358-A:4). Injured persons may sue for actual damages, 2 to 3 times damages for willful or knowing violations, plus costs and attorney's fees.
Also know: Businesses subject to the Gramm-Leach-Bliley Act do not have to notify the credit bureaus. Notice to individuals must include a general description, the approximate date of the breach, the type of information taken and a phone number. A vendor must notify and cooperate with the owner immediately. Unchanged since it took effect on January 1, 2007.

Law: N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 | RSA 359-C:21 Violation. Checked October 13, 2026. Back to the table

New Jersey data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay after discovering or being told of the breach. The business may allow for law enforcement needs and time to find the scope of the breach and restore the system.
Notify the state: Report the breach and any information about it to the Division of State Police in the Department of Law and Public Safety before notifying customers.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is not required if the business establishes that misuse of the information is not reasonably possible. The decision must be documented in writing and kept for five years.
Encryption: Data secured by encryption or any other method that makes it unreadable or unusable is exempt. The statute has no express rule for a stolen key, but dissociated data counts if the means to link it was also accessed.
Data covered beyond the basic set: Online account credentials, linkable dissociated data.
Enforcement: A willful, knowing or reckless violation is an unlawful practice under the New Jersey Consumer Fraud Act and carries that Act's penalties.
Also know: A user name, email address or other account identifier with a password or security question and answer counts. The trigger is unauthorized access, not only acquisition. A vendor must notify the business it holds data for immediately. Last amended in 2019. Bill A3339, introduced January 13, 2026, would add a 5 business day deadline but has not passed.

Law: N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 | N.J. Stat. § 56:8-166 | NJ A3339 (2026 session) and A548 (2024 session). Checked October 13, 2026. Back to the table

New Mexico data breach notification law 45 days

Notify residents: No later than 45 calendar days after discovering the breach, in the most expedient time possible, unless law enforcement asks for a delay.
Notify the state: Notify the Attorney General within 45 calendar days, in the most expedient time possible, if a single breach requires notice to more than 1,000 New Mexico residents. Include the number of residents notified and a copy of the notice.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if, after an appropriate investigation, the business determines the breach does not give rise to a significant risk of identity theft or fraud. The finding does not have to be written down or sent to the AG.
Encryption: Encrypted data is exempt unless the confidential process or key used to decrypt it was also acquired.
Data covered beyond the basic set: Biometric data, government-issued ID number.
Enforcement: The Attorney General may sue for an injunction and damages. For knowing or reckless violations, a court may impose a civil penalty of the greater of $25,000 or $10 per failed notice, capped at $150,000.
Also know: The 45 calendar day limit also applies to notice to the major nationwide credit bureaus. A vendor must notify the owner within 45 calendar days, subject to the same harm test. Businesses subject to the Gramm-Leach-Bliley Act or HIPAA are exempt. The act also requires reasonable security, vendor contracts with security terms, and secure disposal. Unchanged since enactment in 2017.

Law: N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 | N.M. Stat. § 57-12C-10 | N.M. Stat. § 57-12C-11. Checked October 13, 2026. Back to the table

New York data breach notification law 30 days

Notify residents: Within 30 days after the breach is discovered, in the most expedient time possible and without unreasonable delay, unless law enforcement asks for a delay.
Notify the state: If any New York residents are notified, tell the Attorney General, Department of State and Division of State Police the timing, content, distribution and approximate number affected, with a copy of the notice template. DFS covered entities under 23 NYCRR 500 must also notify DFS under 23 NYCRR 500.17.
Credit bureaus: More than 5,000 residents notified.
No-harm exception: Applies only to inadvertent disclosure by authorized users, if the business reasonably determines it will not likely cause misuse, financial harm, or emotional harm (for online credentials). Keep the written decision five years. Send it to the AG within 10 days if more than 500 New York residents are affected.
Encryption: Encrypted data is exempt unless the encryption key has also been accessed or acquired.
Data covered beyond the basic set: Online account credentials, account number alone, biometric data, medical information, health insurance information.
Enforcement: The Attorney General may sue for an injunction and damages. For knowing or reckless violations, a court may impose a civil penalty of the greater of $5,000 or up to $20 per failed notice, with the per-notice amount capped at $250,000.
Recent change: Ch. 647 of 2024 (S.2659-B), effective December 21, 2024, added the 30 day deadline and Department of Financial Services notice. Ch. 91 of 2025 (S.804, signed February 14, 2025) limited that notice to DFS covered entities. Ch. 613 of 2024 (S.2376-B), effective March 21, 2025, added medical and health insurance data.
Also know: DFS notice is due within 72 hours of a cybersecurity event (23 NYCRR 500.17). HIPAA entities that report to HHS must send the AG a copy within 5 business days. Notice under GLBA, HIPAA or 23 NYCRR 500 satisfies resident notice, but not the state agency notice. Vendors must notify the owner immediately and within 30 days of discovery. The AG must sue within 3 years, and no later than 6 years after discovery unless the breach was hidden. The SHIELD Act (899-bb) requires reasonable security.

Law: N.Y. Gen. Bus. Law § 899-aa | S2659 (2023-2024), signed chap.647 | S2376 (2023-2024), signed chap.613. Checked October 13, 2026. Back to the table

North Carolina data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after discovering or being told of the breach. The business may allow for law enforcement needs and time to find contact details, find the scope of the breach and restore the system.
Notify the state: Whenever the business notifies an affected person, it must notify the Consumer Protection Division of the Attorney General's Office without unreasonable delay. Include the nature of the breach, the number of consumers affected, steps taken, and the timing, distribution and content of the notice.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: A breach counts only if illegal use of the personal information has occurred or is reasonably likely to occur, or the incident creates a material risk of harm to a consumer. No documentation or AG filing rule applies to this decision.
Encryption: Encrypted and redacted data is exempt, but access to and acquisition of encrypted data together with the confidential process or key is a breach.
Data covered beyond the basic set: Passport number, taxpayer ID, account number alone, digital signature, biometric data, PIN code, other numbers or information that can access financial resources.
Enforcement: A violation is an unfair or deceptive trade practice under G.S. 75-1.1, enforced by the Attorney General. An injured individual may sue.
Recent change: S.L. 2025-25, s. 29 (House Bill 40, signed June 26, 2025) made wording-only edits such as 'email' and 'website'. The notice rules did not change.
Also know: Covers paper records as well as computerized data. Email addresses, internet account names, passwords and a parent's surname before marriage count only if they would permit access to a financial account or resources. Vendors must notify the owner immediately. A law enforcement delay request must be documented in writing. Financial institutions following the 2005 federal interagency breach guidance are treated as compliant.

Law: N.C. Gen. Stat. §§ 75-61, 75-65 | G.S. 75-61(14) Security breach | G.S. 14-113.20(b) identifying information. Checked October 13, 2026. Back to the table

North Dakota data breach notification law No fixed deadline

Notify residents: Notify affected residents in the most expedient time possible and without unreasonable delay after discovering or being notified of the breach. The statute sets no fixed number of days.
Notify the state: Disclose any breach that exceeds 250 individuals to the Attorney General by mail or email.
Credit bureaus: Not required.
No-harm exception: No risk of harm exception. Notice is owed whenever unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Encryption: Data secured by encryption or another method that makes it unreadable or unusable is exempt. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Date of birth, mother's maiden name, medical information, health insurance information, employer ID or student ID, digital signature.
Enforcement: The Attorney General enforces the chapter with the powers and remedies of the consumer fraud law (chapter 51-15), which allows a civil penalty of up to $5,000 per violation.
Also know: Vendors must notify the owner immediately after discovering a breach. HIPAA entities, financial institutions following federal interagency guidance, and businesses following their own notice policy with the same timing are deemed compliant. HB 1127 (2025, effective August 1, 2025) requires certain nonbank entities regulated by the Department of Financial Institutions to notify the Commissioner within 45 days of an event involving at least 500 consumers (chapter 13-01.2).

Law: N.D. Cent. Code §§ 51-30-01 to 51-30-07 | N.D. Cent. Code § 51-15-11, civil penalties. Checked October 13, 2026. Back to the table

Ohio data breach notification law 45 days

Notify residents: No later than 45 days after discovering or being notified of the breach, in the most expedient time possible.
Notify the state: No notice to the Attorney General or any other state agency is required. The AG is only the enforcer.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: A breach counts only if it causes, or is reasonably believed to have caused or to be likely to cause, a material risk of identity theft or other fraud to an Ohio resident. No documentation rule applies.
Encryption: Data elements that are encrypted, redacted or otherwise altered so they are unreadable are exempt. The statute has no express rule for a stolen key.
Enforcement: Only the Attorney General may sue. Civil penalties for intentional or reckless noncompliance are up to $1,000 per day, rising to $5,000 per day after 60 days and $10,000 per day after 90 days.
Also know: A vendor that holds data for another must notify the owner in an expeditious manner. HIPAA covered entities are outside the law, and financial institutions examined under federal breach notice rules are exempt. Personal information means a name plus a Social Security number, driver's license or state ID number, or a financial account or card number with its access code.

Law: Ohio Rev. Code §§ 1349.19, 1349.191, 1349.192 | Ohio Revised Code Section 1349.192. Checked October 13, 2026. Back to the table

Oklahoma data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after the breach is determined or the business is notified of it. The statute sets no fixed number of days for residents.
Notify the state: Notify the Attorney General without unreasonable delay and no more than 60 days after notifying affected residents. A breach where fewer than 500 residents are affected is exempt.
Credit bureaus: Not required.
No-harm exception: Notice is owed only for a breach that causes, or that the business reasonably believes has caused or will cause, identity theft or other fraud to an Oklahoma resident. No documentation rule applies.
Encryption: Encrypted or redacted data is exempt unless it is accessed and acquired in unencrypted or unredacted form, or the breach involves a person with access to the encryption key.
Data covered beyond the basic set: Biometric data, government-issued ID number, electronic identifier or routing code with access code.
Enforcement: The Attorney General or a district attorney has exclusive authority to sue for actual damages and a civil penalty up to $150,000 per breach. A business with reasonable safeguards that gave proper notice faces no civil penalty. One that lacked safeguards but gave notice faces actual damages and a $75,000 penalty.
Recent change: SB 626 (Laws 2025, c. 406), effective January 1, 2026, added the AG notice for breaches affecting 500 or more residents, added biometric data and other identifiers, and tied civil penalties to reasonable safeguards.
Also know: The AG notice must list set details, including Oklahoma residents affected and estimated monetary impact if known. Medical and health insurance information are not covered. GLBA financial institutions, HIPAA entities and entities following federal regulator rules are deemed compliant only if they also notify the AG. Vendors must notify the owner as soon as practicable. Section 166 applies the Act to breaches determined or notified on or after January 1, 2026.

Law: Okla. Stat. tit. 24, §§ 161 to 166 | Okla. Stat. tit. 24, § 165, as amended by Laws 2025, c. 406, § 4, eff. Jan. 1, 2026. Checked October 13, 2026. Back to the table

Oregon data breach notification law 45 days

Notify residents: No later than 45 days after discovering or receiving notice of the breach, in the most expeditious manner possible and without unreasonable delay.
Notify the state: Notify the Attorney General in writing or electronically if the number of consumers who must be notified exceeds 250.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if, after an appropriate investigation or consultation with law enforcement, the business reasonably determines consumers are unlikely to suffer harm. The decision must be documented in writing and kept for at least five years.
Encryption: Encrypted or redacted data is exempt, but encrypted data still counts if the encryption key has been acquired.
Data covered beyond the basic set: Passport number, biometric data, health insurance information, medical information, online account credentials.
Enforcement: A violation is an unlawful practice under ORS 646.607, enforced by the Attorney General. The Department of Consumer and Business Services director may also impose civil penalties of up to $1,000 per violation, capped at $500,000 per occurrence.
Also know: Vendors must notify the business within 10 days of discovering a breach, and the AG too if more than 250 consumers, or an unknown number, are affected. Data elements count without a name if they would enable identity theft. Offered credit monitoring cannot require a card number or a paid purchase. Entities following GLBA, HIPAA or federal regulator rules are exempt from consumer notice but must still send the AG copies when more than 250 consumers are affected.

Law: Or. Rev. Stat. §§ 646A.600 to 646A.628 (notice rule at § 646A.604) | ORS 646A.604 Notice of breach of security | ORS 646A.624 Powers of director, penalties. Checked October 13, 2026. Back to the table

Pennsylvania data breach notification law No fixed deadline

Notify residents: Without unreasonable delay after determining the breach, subject to any law enforcement delay and the time needed to find the scope of the breach.
Notify the state: Notify the Office of Attorney General at the same time as residents when notice must go to more than 500 affected individuals in Pennsylvania.
Credit bureaus: More than 500 residents notified.
No-harm exception: A breach counts only if it materially compromises the security or confidentiality of personal information and causes, or the business reasonably believes has caused or will cause, loss or injury to a resident. No documentation rule applies.
Encryption: Encrypted or redacted data is exempt unless it was taken in unencrypted form, the breach is linked to a breach of the encryption, or it involves a person with access to the encryption key.
Data covered beyond the basic set: Health insurance information, online account credentials.
Enforcement: A violation is an unfair or deceptive act under the Unfair Trade Practices and Consumer Protection Law. The Attorney General has exclusive authority to bring the action.
Recent change: Act 33 of 2024 (SB 824), signed June 28, 2024 and effective September 26, 2024, added the concurrent AG notice above 500 residents, cut the consumer reporting agency trigger from more than 1,000 to more than 500, and added free credit report and 12 months of credit monitoring duties.
Also know: If a business must notify consumer reporting agencies (more than 500 people at once) and a name was exposed with an SSN, bank account, driver's license or state ID number, it must pay for one independent credit report and 12 months of credit monitoring. Medical information counts only for state agencies and their contractors. Insurers under the insurance data security law are exempt from AG notice. HIPAA-compliant entities are deemed compliant. Vendors must notify the owner.

Law: 73 P.S. §§ 2301 to 2330 (Breach of Personal Information Notification Act, Act 94 of 2005, as amended) | Pennsylvania SB 824 of 2023 to 2024, enacted as Act 33 of 2024. Checked October 13, 2026. Back to the table

Rhode Island data breach notification law 45 days

Notify residents: No later than 45 calendar days after confirming the breach and being able to gather the information the notice must contain, in the most expedient time possible.
Notify the state: Notify the Attorney General and the major credit reporting agencies of the timing, content and distribution of the notices and the approximate number affected, if more than 500 Rhode Island residents are to be notified.
Credit bureaus: More than 500 residents notified.
No-harm exception: Notice is owed only for a disclosure or breach that poses a significant risk of identity theft to a Rhode Island resident. No documentation rule applies.
Encryption: Data encrypted with a 128 bit or higher process is exempt, unless it is acquired together with any key, security code or password.
Data covered beyond the basic set: Medical information, health insurance information, online account credentials, tribal ID number.
Enforcement: The Attorney General may sue. Each reckless violation carries a civil penalty of up to $100 per record, and each knowing and willful violation up to $200 per record.
Also know: Covers paper records and unencrypted electronic data held by anyone who stores, owns, collects, processes, maintains, acquires, uses or licenses it, including vendors. Notices must describe the incident, data, breach and discovery dates, remediation services, and how to get a police report and a security freeze. Businesses need a risk based security program and vendor contracts that protect shared data. An email address counts with a required code or password.

Law: R.I. Gen. Laws §§ 11-49.3-1 to 11-49.3-6 (Identity Theft Protection Act of 2015) | R.I. Gen. Laws § 11-49.3-3 Definitions | R.I. Gen. Laws § 11-49.3-5 Penalties for violation. Checked October 13, 2026. Back to the table

South Carolina data breach notification law No fixed deadline

Notify residents: Notify affected residents in the most expedient time possible and without unreasonable delay after discovering or being notified of the breach.
Notify the state: Notify the Consumer Protection Division of the Department of Consumer Affairs and all nationwide consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notice, if the business notifies more than 1,000 persons at one time.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: A breach counts only when illegal use of the information has occurred or is reasonably likely to occur, or the use creates a material risk of harm to a resident. No documentation rule applies.
Encryption: Data rendered unusable through encryption, redaction or other methods is exempt. The statute does not address a stolen encryption key.
Data covered beyond the basic set: Government-issued ID number, other financial account access information.
Enforcement: A knowing and willful violation brings an administrative fine of $1,000 for each resident whose information was accessible, set by the Department of Consumer Affairs.
Also know: An injured resident may sue for damages for a willful and knowing violation, actual damages for a negligent one, and an injunction, with attorney's fees if successful. A vendor must notify the owner immediately after discovery. Banks and financial institutions subject to GLBA are outside the law. A business that follows its own notice policy with the same timing is deemed compliant. Insurers have separate duties under the South Carolina Insurance Data Security Act.

Law: S.C. Code Ann. § 39-1-90. Checked October 13, 2026. Back to the table

South Dakota data breach notification law 60 days

Notify residents: No later than 60 days after discovering or being notified of the breach, unless law enforcement needs require a longer period.
Notify the state: Disclose any breach that exceeds 250 South Dakota residents to the Attorney General by mail or email. A business using the harm exception must also notify the AG before relying on it.
Credit bureaus: Any notice event.
No-harm exception: No notice is needed if, after an appropriate investigation and notice to the Attorney General, the business reasonably determines the breach will not likely result in harm. The determination must be documented in writing and kept for at least three years.
Encryption: Encrypted data is exempt unless the encryption key was also acquired.
Data covered beyond the basic set: Medical information, employer ID or student ID, online account credentials, government-issued ID number.
Enforcement: The Attorney General may prosecute each failure to disclose as a deceptive act or practice and seek a civil penalty of up to $10,000 per day per violation.
Also know: Online credentials and account numbers with access codes count even without a name. Medical information means health information as defined in HIPAA rules. An employer ID number counts with a required code, password or biometric data. If law enforcement delays notice, notice is due within 30 days after it says notice will not compromise the investigation. Businesses that follow their federal regulator's breach procedures are deemed compliant.

Law: S.D. Codified Laws §§ 22-40-19 to 22-40-26 | SDCL 22-40-20 Notice of breach of system security, exception | SDCL 22-40-24 Notice to consumer reporting agencies. Checked October 13, 2026. Back to the table

Tennessee data breach notification law 45 days

Notify residents: Within 45 days after discovering or being notified of the breach, unless law enforcement needs a delay.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No harm exception. Notice is required when personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Encryption: Encrypted data is exempt unless the encryption key was also acquired. Encryption must meet the FIPS 140-2 standard.
Enforcement: The Attorney General may sue under § 47-18-2105. Any violation is subject to a civil penalty of the greatest of $10,000, $5,000 per day a person's identity has been assumed, or ten times the amount obtained or attempted. Injured customers may also sue.
Also know: Vendors that only maintain data must tell the data owner within the same 45 days. Businesses subject to GLBA Title V or HIPAA are exempt from this section. Tennessee's separate privacy law (Tennessee Information Protection Act, in force July 1, 2025) did not change these notice rules.

Law: Tenn. Code Ann. § 47-18-2107 | Tennessee Code § 47-18-2105. Checked October 13, 2026. Back to the table

Texas data breach notification law 60 days

Notify residents: Without unreasonable delay and no later than 60 days after the business determines that the breach occurred.
Notify the state: Notify the Attorney General on the AG's online form as soon as practicable and no later than 30 days after determining the breach occurred, if it involves at least 250 Texas residents.
Credit bureaus: More than 10,000 residents notified.
No-harm exception: No harm exception. Notice is required for any unauthorized acquisition that compromises sensitive personal information.
Encryption: Encrypted data is exempt unless the person who accessed it has the key needed to decrypt it.
Data covered beyond the basic set: Medical information, government-issued ID number.
Enforcement: The Attorney General may seek a civil penalty of $2,000 to $50,000 per violation, plus up to $100 per individual per day of failure to notify, capped at $250,000 for a single breach.
Recent change: S.B. 2610 (2025), effective September 1, 2025, added Chapter 542. A Texas business with fewer than 250 employees that kept a qualifying cybersecurity program at the time of a breach cannot be made to pay exemplary damages in a breach lawsuit. The notice rules were last changed by S.B. 768, effective September 1, 2023.
Also know: The individual notice duty covers affected people in any state. For residents of a state with its own notice law, the business may follow that state's law instead. Health information that identifies a person counts as sensitive personal information on its own. The AG posts a public list of reported breaches. Vendors that only maintain data must tell the owner immediately after discovery. Section 521.052 requires reasonable security procedures.

Law: Tex. Bus. & Com. Code §§ 521.002, 521.053, 521.151 | Tex. Bus. & Com. Code § 521.053 | S.B. 768 (88th Leg.), enrolled, amending § 521.053(i). Checked October 13, 2026. Back to the table

Utah data breach notification law No fixed deadline

Notify residents: In the most expedient time possible without unreasonable delay, once a prompt, good faith investigation shows misuse for identity theft or fraud has occurred or is reasonably likely.
Notify the state: Notify the Office of the Attorney General and the Utah Cyber Center if misuse relating to 500 or more Utah residents has occurred or is reasonably likely. Include the breach and discovery dates, total and Utah numbers affected, data types and a short description.
Credit bureaus: 1,000 or more residents notified.
No-harm exception: Notice is required only if the investigation shows misuse for identity theft or fraud has occurred or is reasonably likely to occur. A no-notice decision does not have to be documented or reported.
Encryption: Personal information is covered only when unencrypted or not protected by another method that makes it unreadable or unusable. The statute has no key exception.
Enforcement: The Attorney General may seek a civil penalty up to $2,500 per violation for a specific consumer and up to $100,000 in total for related violations. Higher amounts are possible when 10,000 or more Utah residents and 10,000 or more other residents are involved.
Recent change: A 2024 amendment (Laws of Utah 2024, ch. 426), effective May 1, 2024, updated the Utah Cyber Center reference and the confidentiality rules for reports to the AG and Cyber Center. A 2025 amendment (ch. 173, effective May 7, 2025) changed the enforcement section, § 13-44-301, but not the penalty amounts.
Also know: Vendors that maintain data must notify and cooperate with the owner immediately after discovery when misuse is likely. Law enforcement may ask for a delay. Section 13-44-201 requires reasonable procedures to protect personal information.

Law: Utah Code §§ 13-44-101 to 13-44-301 | Utah Code § 13-44-202 (effective 5/1/2024) | Utah Code § 13-44-301 (effective 5/7/2025). Checked October 13, 2026. Back to the table

Vermont data breach notification law 45 days

Notify residents: In the most expedient time possible and without unreasonable delay, but no later than 45 days after the business discovers or is notified of the breach.
Notify the state: Within 14 business days of discovery or consumer notice, whichever is sooner, give the AG (or the Department) preliminary notice. At consumer notice, add the Vermont count and notice copy. A business that swore to the AG before the breach that it has written security policies may instead notify the AG before consumers.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: No notice is needed if the business establishes that misuse of the personal information or login credentials is not reasonably possible. It must send that determination and a detailed explanation to the Attorney General or the Department of Financial Regulation.
Encryption: Data elements that are encrypted, redacted, or protected by another method that makes them unreadable or unusable are not covered.
Data covered beyond the basic set: Online account credentials, taxpayer ID, passport number, military ID, account number alone, financial account password or PIN, biometric data, genetic data, medical information, health insurance information.
Enforcement: The Attorney General and State's Attorneys have sole and full authority to enforce, using their consumer protection powers under chapter 63 of Title 9. The Department of Financial Regulation enforces against entities it licenses or registers.
Recent change: Act 138 of 2026 (H.211), signed June 16, 2026, amends §§ 2430 and 2435 effective January 1, 2027. A name will not be needed when a listed data element alone is enough to attempt identity theft, and a new § 2436 sets breach notice rules for data brokers. The current rule applies until then.
Also know: A breach of login credentials alone can be noticed electronically, but an email account breach may not be noticed through that email account. AG notice for a login-credentials-only breach is needed only if the credentials were taken directly from the business or its agent. Financial institutions covered by federal interagency guidance are exempt but must notify the Department of Financial Regulation as soon as possible. Vendors that maintain data must tell the owner.

Law: 9 V.S.A. §§ 2430, 2435 | 9 V.S.A. § 2430(10) | Act 138 (H.211) As Enacted, 2026. Checked October 13, 2026. Back to the table

Virginia data breach notification law No fixed deadline

Notify residents: Without unreasonable delay. The statute sets no fixed day limit.
Notify the state: Notify the Office of the Attorney General and affected Virginia residents of any breach without unreasonable delay. If more than 1,000 persons are notified at one time, also tell the AG and the nationwide consumer reporting agencies the timing, distribution and content of the notice.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: A breach counts only when the business reasonably believes it has caused, or will cause, identity theft or other fraud to a Virginia resident. A no-notice decision does not have to be documented.
Encryption: Encrypted or redacted data is exempt unless it was acquired in unencrypted form or the breach involves a person with access to the encryption key.
Data covered beyond the basic set: Passport number, military ID.
Enforcement: The Attorney General may bring an action and impose a civil penalty of up to $150,000 per breach or series of similar breaches found in a single investigation.
Also know: The statute does not limit an individual from recovering direct economic damages, but it does not expressly create a right to sue. Employers and payroll service providers must also notify the AG when a taxpayer ID number together with income tax withheld is compromised. Vendors that maintain data must tell the owner. A separate law covers medical information breaches (Va. Code § 32.1-127.1:05).

Law: Va. Code § 18.2-186.6. Checked October 13, 2026. Back to the table

Washington data breach notification law 30 days

Notify residents: In the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered.
Notify the state: Notify the Attorney General no more than 30 days after the breach was discovered, if a single breach requires notice to more than 500 Washington residents. Include the number affected, data types, exposure timeframe, containment summary and a sample notice, and update the AG if details were unknown at first.
Credit bureaus: Not required.
No-harm exception: Notice is not required if the breach is not reasonably likely to subject consumers to a risk of harm. The determination does not have to be documented.
Encryption: Secured data (encrypted to NIST standards or otherwise made unreadable) is exempt unless the key or other means to decipher it was also acquired.
Data covered beyond the basic set: Online account credentials, date of birth, digital signature, employer ID or student ID, military ID, passport number, health insurance information, medical information, biometric data.
Enforcement: The Attorney General may sue, and a violation is an unfair or deceptive act under the Consumer Protection Act (chapter 19.86 RCW).
Also know: Covered data elements count even without a name if they are not secured and would enable identity theft. A private key used to sign or authenticate an electronic record is covered. Businesses that process card payments can be liable to financial institutions for card-reissue costs after a breach (RCW 19.255.020). The AG posts notices publicly.

Law: RCW 19.255.005 to 19.255.040 | RCW 19.255.040(3)(a) | RCW 19.255.005. Checked October 13, 2026. Back to the table

West Virginia data breach notification law No fixed deadline

Notify residents: Without unreasonable delay. The business may allow for law enforcement needs and steps to find the scope of the breach and restore the system.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: More than 1,000 residents notified.
No-harm exception: Notice is required only when the business reasonably believes the breach has caused or will cause identity theft or other fraud to a West Virginia resident. The determination does not have to be documented.
Encryption: Encrypted or redacted data is exempt unless it was acquired in unencrypted form or the breach involves a person with access to the encryption key.
Enforcement: Failure to notify is an unfair or deceptive act enforced only by the Attorney General. A civil penalty applies only to a course of repeated and willful violations and is capped at $150,000 per breach or series of similar breaches.
Also know: Businesses subject to GLBA Title V do not have to notify consumer reporting agencies. Vendors that maintain data must tell the owner as soon as practicable. Licensed financial institutions are enforced by their primary federal or state regulator.

Law: W. Va. Code §§ 46A-2A-101 to 46A-2A-105 | W. Va. Code § 46A-2A-104 | W. Va. Code § 46A-2A-101. Checked October 13, 2026. Back to the table

Wisconsin data breach notification law 45 days

Notify residents: Within a reasonable time, not to exceed 45 days after the business learns personal information was acquired.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: 1,000 or more residents notified.
No-harm exception: No notice is needed if the acquisition does not create a material risk of identity theft or fraud. The determination does not have to be documented.
Encryption: Data elements that are encrypted, redacted, or altered so they are unreadable are not covered. The statute has no key exception.
Data covered beyond the basic set: Account number alone, biometric data, genetic data.
Enforcement: The statute sets no penalty. Failure to comply is not negligence or a breach of duty by itself, but may be evidence of negligence.
Also know: A business based in Wisconsin, or that keeps the data in Wisconsin, must notify every affected person, not only Wisconsin residents. A financial account number counts alone, and so does a code or password that gives access to the account. Businesses subject to and in compliance with GLBA that have a breach policy are exempt. Vendors must tell the owner.

Law: Wis. Stat. § 134.98. Checked October 13, 2026. Back to the table

Wyoming data breach notification law No fixed deadline

Notify residents: In the most expedient time possible and without unreasonable delay, after a prompt, good faith investigation finds misuse has occurred or is reasonably likely.
Notify the state: No notice to the Attorney General or any other state agency is required.
Credit bureaus: Not required.
No-harm exception: Notice is required only if the investigation finds misuse of personal identifying information has occurred or is reasonably likely to occur. The determination does not have to be documented.
Encryption: Only redacted data (no more than five digits accessible) is exempt. The statute does not mention encryption.
Data covered beyond the basic set: Online account credentials, medical information, health insurance information, biometric data, taxpayer ID, tribal ID card, government-issued ID card, shared secrets or security tokens, birth or marriage certificate.
Enforcement: The Attorney General may bring an action in law or equity to address violations and recover damages. No civil penalty amount is set.
Also know: Notices must include a toll-free number where people can get consumer reporting agency contact details, plus the types of data involved, a description of the breach, its approximate date and advice to watch account statements and credit reports. Vendors that maintain data must tell the owner as soon as practicable. GLBA financial institutions and HIPAA covered entities that follow federal rules are deemed compliant.

Law: Wyo. Stat. §§ 40-12-501 to 40-12-502 | 2025 Wyoming Statutes § 40-12-501(a)(viii) | 2025 Wyoming Statutes § 6-3-901(b). Checked October 13, 2026. Back to the table

Common questions

Do all 50 states have data breach notification laws?

Yes. All 50 states and the District of Columbia have laws that require private businesses to notify people when their personal information is breached, and so do Guam, Puerto Rico and the US Virgin Islands ¹. Georgia's law is narrow: it covers only information brokers and government agencies, so most Georgia businesses fall outside it. The rules differ on deadlines, who else must be told and what counts as personal information.

Which state has the shortest data breach notification deadline?

Among fixed deadlines, 30 days is the shortest for notifying residents, in California, Colorado, Florida, Maine, New York and Washington. Some notices to the state are due sooner: Vermont wants a preliminary notice to the attorney general within 14 business days, and Maryland and New Jersey want the state told before residents.

Which state's law applies if affected people live in several states?

Each state's law protects its own residents, so you follow the law of every state where affected people live. A breach of 2,000 records spread across ten states can mean ten sets of deadlines and several notices to attorneys general. Plan to the strictest rule that applies.

Do I have to notify the attorney general after a data breach?

In 37 of the 51 jurisdictions you do, at least for larger breaches. 14 states require it for any breach that triggers resident notice, and the rest use a threshold between 50 and 1,000 affected residents. 13 states require no notice to a state agency.

If the data was encrypted, do I still have to notify anyone?

Usually not. 50 of the 51 laws exempt encrypted data unless the encryption key was also taken or the data could be read. Wyoming's law exempts only redacted data. Document how the data was encrypted, because you may need to prove it.

What counts as personal information under state breach laws?

Every state covers a name with a Social Security number, driver's license number or financial account number with its access code. Many add more: 22 laws cover medical information, 22 cover biometric data such as fingerprints, and 21 cover a username or email address with its password. Each state's row lists its extra data types.

What is the HIPAA breach notification deadline?

HIPAA requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery ². If 500 or more people are affected, HHS must be notified at the same time ³. State law can be stricter, so a health care business still checks the state rows.

Sources

National Conference of State Legislatures, Security Breach Notification Laws, 2022-01-17.
eCFR, 45 CFR Part 164, Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information, 2026-10-08.
HHS Office for Civil Rights, Submitting Notice of a Breach to the Secretary, 2026.
eCFR, 16 CFR Part 314: Standards for Safeguarding Customer Information, 2026-10-08.
Federal Register (SEC), Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, 2024-06-03.
Federal Trade Commission, Cyber Insurance, 2021-11-09.
FBI, Ransomware, 2026-04-08.
Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.

Updated October 13, 2026.

Data Breach Notification Laws by State

Get a quote for my business

Quote request sent

State breach notification laws: the table

How state breach notification laws work

Notification deadlines: 30, 45 or 60 days, or without unreasonable delay

When you must also notify the attorney general

Exceptions: no-harm decisions and encryption

Changes in 2024, 2025 and 2026

Federal rules that apply on top of state law

What to do in the first days after a breach

How we built this table

Each state's rule in full

Alabama data breach notification law 45 days

Alaska data breach notification law No fixed deadline

Arizona data breach notification law 45 days

Arkansas data breach notification law No fixed deadline

California data breach notification law 30 days

Colorado data breach notification law 30 days

Connecticut data breach notification law 60 days

Delaware data breach notification law 60 days

District of Columbia data breach notification law No fixed deadline

Florida data breach notification law 30 days

Georgia data breach notification law No fixed deadline

Hawaii data breach notification law No fixed deadline

Idaho data breach notification law No fixed deadline

Illinois data breach notification law No fixed deadline

Indiana data breach notification law 45 days

Iowa data breach notification law No fixed deadline

Kansas data breach notification law No fixed deadline

Kentucky data breach notification law No fixed deadline

Louisiana data breach notification law 60 days

Maine data breach notification law 30 days

Maryland data breach notification law 45 days

Massachusetts data breach notification law No fixed deadline

Michigan data breach notification law No fixed deadline

Minnesota data breach notification law No fixed deadline

Mississippi data breach notification law No fixed deadline

Missouri data breach notification law No fixed deadline

Montana data breach notification law No fixed deadline

Nebraska data breach notification law No fixed deadline

Nevada data breach notification law No fixed deadline

New Hampshire data breach notification law No fixed deadline

New Jersey data breach notification law No fixed deadline

New Mexico data breach notification law 45 days

New York data breach notification law 30 days

North Carolina data breach notification law No fixed deadline

North Dakota data breach notification law No fixed deadline

Ohio data breach notification law 45 days

Oklahoma data breach notification law No fixed deadline

Oregon data breach notification law 45 days

Pennsylvania data breach notification law No fixed deadline

Rhode Island data breach notification law 45 days

South Carolina data breach notification law No fixed deadline

South Dakota data breach notification law 60 days

Tennessee data breach notification law 45 days

Texas data breach notification law 60 days

Utah data breach notification law No fixed deadline

Vermont data breach notification law 45 days

Virginia data breach notification law No fixed deadline

Washington data breach notification law 30 days

West Virginia data breach notification law No fixed deadline

Wisconsin data breach notification law 45 days

Wyoming data breach notification law No fixed deadline

Common questions

Related guides

Sources

Tell us what you need