Arkansas Data Breach Notification Law

How the Arkansas data breach notification law works

No number of days governs a breach of computerized personal information in Arkansas ¹. The standard is the most expedient time and manner possible and without unreasonable delay, and it makes room for police requests and for working out the scope and getting systems back ¹.

Medical, biometric and genetic data join the familiar identifiers on Arkansas's list ¹. Biometric here means fingerprints, faceprints, retina or iris scans, voiceprints and DNA, so a fingerprint time clock or face-scan door reader puts a business squarely in scope.

Insurance licensees work under a separate insurance code rule. The breach section itself was last amended by Act 1030 of 2019, and nothing changed from 2024 to 2026 ¹.

Because there is no fixed deadline, keep a short dated timeline from the first alert: when the incident was found, when the forensic team confirmed what was taken, and when each set of letters went out. If anyone later asks whether notice was expedient, that timeline is the answer.

The Attorney General notice and its 45-day backstop

Above 1,000 individuals, the Attorney General hears from you either alongside the individual letters or within 45 days of concluding there is a reasonable likelihood of harm, whichever date comes sooner ¹. The text reads "more than 1,000"; some summaries misprint it as "1,000 or more".

Oddly, the Attorney General sentence sits in a subdivision that cross-refers to the vendor rules. The office itself and published summaries read it as covering every breach above 1,000, so plan to file and raise the quirk with counsel only if it matters.

Credit bureaus are never part of an Arkansas notice. Outside firms holding a client's records owe that client notice immediately after discovering a breach ¹.

The no-harm decision must be kept for five years

A reasonable investigation that finds no reasonable likelihood of harm to customers lets a business skip the letters ¹. Arkansas then wants paper: the written determination and its supporting documents, kept five years and produced within 30 days if the Attorney General asks in writing ¹.

Draft it for that reader, since the statute expects the Attorney General may see it. The forensic report from your breach response firm is the backbone of the file.

Encrypted or redacted names and data elements fall outside the law ¹. Nothing addresses a stolen key, so that case belongs with counsel.

Enforcement, and the first hours of a breach

Violations are pursued by the Attorney General under the Arkansas Deceptive Trade Practices Act, and the breach section carries no penalty figure of its own ². Private lawsuits go unmentioned.

During a live attack, an Arkansas company with cyber coverage puts in its claim first, sends the FBI a report via ic3.gov, and leaves every affected device as it is until the forensic image is taken ³⁴⁵. Expect the carrier to pick the lawyers and investigators; standard policy conditions explains how that works.

Once contained, sort people by where they live, since workers or customers in Texas or Tennessee bring those states' deadlines. Every state's rule is in our breach notice comparison, and protections that keep a small firm's next incident small covers prevention.

Last reviewed against § 4-110-105: October 13, 2026. We offer general information, not legal advice, and a no-harm finding that must survive an Attorney General request deserves an Arkansas lawyer's review first.