The Louisiana rule in full 60 days
La. Rev. Stat. §§ 51:3071 to 51:3077; La. Admin. Code tit. 16, pt. III, § 701
- Notify residents
- No later than 60 days after discovering the breach, in the most expedient time possible and without unreasonable delay.
- Notify the state
- Send the Attorney General written notice, with the names of all Louisiana residents affected, within 10 days of notifying residents. This duty comes from an AG rule (LAC 16:III.701), not the statute. Under the statute, if resident notice is delayed past 60 days, give the AG written reasons within the 60 days.
- Credit bureaus
- Not required.
- No-harm exception
- No notice is needed if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to Louisiana residents. It must keep the written determination and supporting documents for five years and send them to the AG within 30 days of a written request.
- Encryption
- Encrypted or redacted data is not personal information under the statute. The statute does not address a stolen encryption key.
- Data covered beyond the basic set
- Passport number, biometric data.
- Enforcement
- A violation is an unfair or deceptive trade practice under the Louisiana Unfair Trade Practices Act (R.S. 51:1405). Individuals may sue for actual damages from a failure to disclose on time. Under the AG rule, late AG notice can bring a fine up to $5,000 per violation, with each day a separate violation.
- Also know
- The AG has an online form for its notice. The statute also requires reasonable security procedures and secure disposal of personal information. A vendor that only maintains the data must notify the owner, under the same 60-day outer limit. Financial institutions that follow the federal interagency guidance are deemed compliant.
Law: La. Rev. Stat. §§ 51:3071 to 51:3077; La. Admin. Code tit. 16, pt. III, § 701 | RS 51:3073 (definitions) | RS 51:3075 Recovery of damages. Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: Texas, Arkansas, Mississippi. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe Louisiana data breach notification law and its 60-day limit
La. Rev. Stat. §§ 51:3071 to 51:3077 starts a 60-day count on the day a breach is discovered 1. Day 60 is a ceiling; within it, residents should hear in the most expedient time possible and without unreasonable delay.
Running late is allowed only with an explanation. If the letters will miss day 60, the Attorney General must receive the reasons in writing before the 60 days end 1. Silence past day 60 is the one outcome to avoid.
Louisiana never requires a credit bureau notice.
The Attorney General notice comes from a rule, not the statute
Owners who read only the statute miss the 10-day filing, because it lives in LAC 16:III.701, the Attorney General's rule 2. The filing is on time if it arrives within 10 days after the resident letters are sent, and it must list the names of all affected Louisiana residents. The office accepts it through an online form.
The rule carries its own fine: up to $5,000 per violation, with every day late counted as a new violation 2. Mail residents on day 50, forget the Attorney General, and the daily fines start stacking.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessThe no-harm exception and its records
A reasonable investigation that finds no reasonable likelihood of harm to Louisiana residents removes the duty to notify 1. The price is record keeping: the written determination and its supporting papers stay on file five years and go to the Attorney General within 30 days of a written request.
Encrypted or redacted data falls outside the statute's definition of personal information 3, and a stolen key is not addressed. Passport numbers and biometric data are protected here, beyond the usual Social Security, driver's license and account numbers 3.
Penalties and private lawsuits in Louisiana
Residents hurt by a late notice can go to court for actual damages caused by the failure to disclose on time 4. A violation also counts as an unfair act or practice under the Louisiana Unfair Trade Practices Act 1.
Two standing duties sit alongside the notice rule: reasonable security procedures and secure disposal of personal information 1. Service providers holding a client's data work to the same 60-day outer limit when they warn that client. Financial institutions following the federal interagency guidance are deemed compliant.
A Louisiana breach checklist
Before anything else in a live attack: open a claim with your cyber carrier if you have one, send the FBI a report through ic3.gov, and keep every affected machine intact for the forensic copy 567.
- Let a containment specialist or your regular IT support stop the intrusion and confirm what was taken.
- Calendar two dates: day 60 for the resident letters, and 10 days after mailing for the Attorney General filing.
- Map each person to a home state. Texas also allows 60 days but wants an Attorney General report once at least 250 Texans are affected, and Mississippi has no fixed deadline. Other states are in the state notice comparison chart.
- Compare your policy's conditions with what cyber carriers usually demand.
Our New Orleans and Baton Rouge guides compare local IT support.
Both La. Rev. Stat. 51:3074 and LAC 16:III.701 were compared with this summary on October 13, 2026. A Louisiana attorney should confirm your duties; we do not give legal advice.
Common questions
How many days does the Louisiana data breach notification law allow?
Sixty days from discovery at the latest, sooner where possible 1. Missing day 60 requires a written explanation to the Attorney General before it passes.
Does the Louisiana Attorney General have to be told about a breach?
Yes, by rule rather than statute: a written filing naming every affected Louisiana resident, within 10 days after the resident letters 2. Lateness can cost up to $5,000 per violation, and each day is a separate violation.
Can individuals sue over a late breach notice in Louisiana?
Yes, for actual damages caused by a failure to disclose in time 4.
Does Louisiana's breach law apply to encrypted data?
No, it is outside the definition 3. What happens when the key is stolen is not addressed.
Does Louisiana require notice to the credit bureaus?
No. Louisiana leaves the bureaus out entirely 1.
Sources
- Louisiana State Legislature, RS 51:3074, 2026.
- Louisiana Department of Justice, Office of the Attorney General, Data Security Breach Notification (LAC 16:III.701), 2026.
- Louisiana State Legislature, RS 51:3073 (definitions), 2026.
- Louisiana State Legislature, RS 51:3075 Recovery of damages, 2026.
- FBI, Ransomware, 2026-04-08.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.