Alaska Data Breach Notification Law

The Alaska data breach notification law counts paper records

Personal information in any form is protected, printed pages included ¹, where many states cover only computer files. A box of personnel records stolen from a truck in Anchorage can be an Alaska breach.

The timing words are "most expeditious time possible and without unreasonable delay," with allowance for police requests, for scoping and for restoring systems ². With no day count, a dated log explaining each day is your proof the pace was reasonable.

The card rule is broad too: an account, credit or debit card number counts alone, unless the account opens only with a code, in which case the number and code together count ¹. Passwords and access codes for financial accounts are also on the list ¹, so a shared spreadsheet holding the office's bank portal login can be a notice event by itself.

Paper deserves its own controls here: locked cabinets for personnel and payroll files, a shredding routine for printed reports, and a sign-out sheet for anything that leaves the building. Those habits cost little and keep a lost folder from turning into a round of letters.

Skipping notice means telling the Attorney General first

Alaska reverses the usual harm exception. Silence toward residents is allowed only after an appropriate investigation and a written notice to the Attorney General that harm to consumers is not reasonably likely ². The decision goes in writing and stays on file for five years ².

So the Attorney General hears from you in exactly one situation: when you choose not to notify residents. No headcount triggers a filing ². Since the office reads your reasoning before you can lean on it, write it as a brief report covering the incident, the data, the forensic findings and why harm is unlikely, and have counsel review it before it goes.

Credit bureaus, data from others and penalties

Letters to more than 1,000 Alaskans mean the consumer reporting agencies hear too, except from Gramm-Leach-Bliley businesses ³. A company holding data it got from someone else must warn that source immediately after discovering a breach ¹.

Violations count as unfair or deceptive acts under the Alaska Unfair Trade Practices Act, with a civil penalty of up to $500 per resident left uninformed and a $50,000 ceiling ⁴. The breach statute grants no lawsuit by name, but it caps private claims under that Act at actual economic damages ⁴.

The first days of an Alaska breach

While the incident is live, an insured Alaska business phones its carrier first, sends the FBI a report through ic3.gov, and leaves the affected computers untouched until they are imaged ⁵⁶⁷. Carriers often choose the breach lawyer, so ask before hiring one; what carriers require up front covers the usual conditions.

A breach containment team, or whoever runs your network day to day, then shuts the intrusion down. Add paper to the inventory (printed payroll runs, signed intake forms), because Alaska counts it. Seasonal workers and customers may live in Washington or elsewhere, and their home states' laws follow them; each state's deadline is in our table, and prevention basics for small firms covers the next step.

Our reading of AS 45.48 matches the statute as of October 13, 2026. None of it is legal advice; for your own incident, talk to an Alaska attorney.