Maine Data Breach Notification Law

How the Maine data breach notification law's 30-day clock works

Section 1348 of Title 10 puts Maine among the 30-day states ¹. Two conditions start the count, awareness of the breach and identification of its scope, and the letters should still leave as expediently as possible and without unreasonable delay.

A law enforcement delay is allowed, but it is short. Once the agency says notice will no longer compromise its investigation, the business has no more than 7 business days to send it ¹.

The state notice goes to one of two places. A business regulated by the Department of Professional and Financial Regulation reports to its regulator there. Everyone else reports to the Attorney General, which has an online form ¹.

A low bar for notice in Maine

Notice is required if a good faith, reasonable and prompt investigation finds that misuse of the personal information has occurred or is reasonably possible ¹. "Reasonably possible" is a low threshold, so skipping notice requires an investigation that shows misuse is not even reasonably possible. Information brokers have no exception at all: they must notify whenever data was, or is reasonably believed to have been, acquired by an unauthorized person.

Maine's definition of covered data is also wider than the basics ²:

• Account passwords, PINs and other access codes
• An account, credit card or debit card number on its own, if it could be used without further codes or passwords
• Data elements without a name, if they would be enough to let someone assume the person's identity

Data is covered only when it is not encrypted or redacted ². The statute does not address a stolen key.

Penalties and enforcement in Maine

A violation is a civil violation. The Department of Professional and Financial Regulation enforces the law for businesses it regulates, and the Attorney General for all others ³. Fines run up to $500 per violation and up to $2,500 for each day, plus equitable relief or an injunction. The statute is silent on private suits and says its remedies are cumulative, so whether residents can sue is unsettled.

When federal rules also apply

Several federal clocks run longer than Maine's, which makes the state date the one to plan around. Under HIPAA a medical or dental office has up to 60 calendar days from discovery, with no unreasonable delay ⁴; for Maine patients, work to 30 days unless counsel says the HIPAA letter satisfies the state. Our HIPAA notice summary covers the federal half. Tax preparers, mortgage brokers and similar non-bank firms under the FTC Safeguards Rule also owe the FTC a report within 30 days of discovering a breach touching at least 500 consumers ⁵.

Starting Maine's 30-day count

If the breach is still unfolding, a Maine business with cyber insurance reports to its carrier before calling anyone else, files at ic3.gov so the FBI has a record, and leaves systems as they are until the evidence is safe ⁶⁷⁸.

A containment and forensics firm, or your own IT support, then stops the attack and defines the scope, and that moment starts Maine's 30 days. Group people by home state: New Hampshire and Massachusetts residents bring their own rules, and each state's law is in our table. Measure your controls against carrier security expectations and small business security basics.

Section 1348 was reread for this page on October 13, 2026. Use the summary as background, not as legal advice, and ask a Maine attorney to confirm your duties.