Illinois Data Breach Notification Law

The Illinois data breach notification law: no deadline, no harm exception

Illinois handles breach notice through the Personal Information Protection Act, 815 ILCS 530 ¹. It applies to "data collectors", a broad term that includes businesses handling nonpublic personal information about Illinois residents ³. These rules shape every Illinois response:

• No fixed deadline. Notice is due in the most expedient time possible and without unreasonable delay. The business may take time to find the scope of the breach and restore the system, but nothing more is spelled out ².
• No harm exception. A conclusion that misuse is unlikely does not excuse the letters. Acquisition of covered unencrypted data is enough.
• Attorney General notice above 500. More than 500 Illinois residents in one breach means the Attorney General hears about it too ².

The law also requires reasonable security for the data you keep ³.

How fast is fast enough without a deadline

A defensible pace is one you could explain to the Attorney General later, given what you knew each day. With no number in the statute, pick one yourself and hold to it.

Out-of-state residents often pick it for you. Chicago-area firms commonly employ or serve people across the line, and Indiana allows 45 days with Attorney General notice for any breach, while Wisconsin has a rule of its own. Each state protects its own residents, so the tightest deadline on your list becomes the one to plan around; our breach deadline comparison shows them all.

Attorney General notice and what residents are told

When a single breach requires notice to more than 500 Illinois residents, notify the Attorney General no later than you notify the residents ². The Attorney General may publish the business name, the types of data involved and the breach dates ², so assume the notice will be public.

Two Illinois details are easy to miss:

• Do not state the Illinois count in the resident letter. The notice to residents must not say how many Illinois residents were affected ².
• HIPAA entities have a 5-business-day rule. A HIPAA-covered business that complies with HIPAA is treated as compliant with the Illinois law, but if it notifies HHS of a breach it must also notify the Illinois Attorney General within 5 business days ³. See our HIPAA breach notification rule guide.

Vendors that keep data for a business must notify the owner immediately and cooperate with its response ².

Data covered, and when encryption protects you

Illinois covers the standard elements plus ³:

• A username or email address with the password or security question that opens an online account
• Medical and health insurance information
• Biometric data, such as a fingerprint or face scan used to identify someone

The financial account wording is unusual. Read literally, section 5 covers an account or card number on its own, even without the code needed to use it. Some published charts read it as requiring the code, so treat a breach of bare account numbers as one to review with counsel rather than one to dismiss.

Encrypted or redacted data is exempt unless the keys needed to read it were acquired through the breach ³. Laptop, phone and backup encryption, an early step in security for a small company, pays off directly here.

Enforcement, lawsuits and BIPA

A violation of the breach law is an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act, and the breach statute sets no separate penalty amount ³. Whether individuals can sue is unclear: the breach law does not grant a right to sue itself, but the Consumer Fraud Act it points to has its own private action provision.

The bigger litigation risk in Illinois is often the Biometric Information Privacy Act. It requires a published retention and destruction schedule, written notice and a written release before collecting biometric data such as fingerprints or face geometry ⁴. Individuals can sue for $1,000 per negligent violation or $5,000 per intentional or reckless violation ⁴. Since August 2, 2024, repeated collection of the same identifier from the same person by the same method counts as one violation ⁴. Fingerprint time clocks and face-scan door systems fall in this zone, and a breach of that data can trigger both laws.

Setting your Illinois notice date

While the attack is live, an insured Illinois business opens its claim with the carrier, files an FBI complaint at ic3.gov, and keeps the affected systems as they are until evidence is copied ⁶⁸⁷. Carriers frequently assign counsel and forensics, so the claim call comes before any lawyer is hired; carrier conditions explained covers the rest.

After your in-house IT staff or a forensic response firm has the intrusion contained, list people by state and set the notice date from the strictest rule on the list. IC3 logged 32,977 complaints from Illinois in 2025, fifth among the states, with about $535 million lost ⁵. Chicago-area pricing for ongoing support is on our Chicago managed IT page.

This page tracks 815 ILCS 530 as of October 13, 2026. General guidance cannot weigh your facts, so take legal advice from Illinois counsel, on BIPA questions above all.