Michigan Data Breach Notification Law

The Michigan data breach notification law today

MCL 445.72, last changed by 2010 PA 315, asks for letters to affected Michigan residents without unreasonable delay ¹. Scoping the breach and restoring systems count as reasonable time, and a police request can put notice on hold.

Today the statute has neither a day count nor a state filing ¹. The bureaus, at more than 1,000 residents notified, are the only outsiders who must be told.

Lawmakers are trying to change that. Senate Bills 360 to 364 of 2025 would add a 45-day limit and an Attorney General filing; the package cleared the Senate on August 26, 2025, went to a House committee, and was still sitting there at our last check ². None of it is law yet.

When Michigan lets you skip notice

Letters can be skipped when the business concludes the breach has not caused and is not likely to cause substantial loss or injury to any Michigan resident, or identity theft ¹. Reaching that conclusion takes the care of an ordinarily prudent person.

Michigan does not require it in writing. Put it there regardless: if the Attorney General later doubts the call, the forensic report and your notes are how you show ordinary prudence.

Encryption keeps data out of the law unless the person who took it had unauthorized access to the key ¹. A laptop that walks off with its password taped inside the lid is not protected.

Penalties for missing or false notices

Each knowing failure to notify can draw a civil fine of up to $250, up to $750,000 for one breach, sought by the Attorney General or a county prosecutor ¹. A fake breach notice sent to defraud people is a misdemeanor.

There is no lawsuit built into the section, though it preserves other civil remedies ¹. A resident suing on some other theory is possible; ask counsel.

A hosting company or other firm that stores a client's records must tell that client about a breach ¹.

Federal rules and the pending bills: plan for a clock anyway

An open-ended state rule still leaves many Michigan firms with a hard federal date:

• Medical practices and their business associates answer to HIPAA, which caps patient letters at 60 calendar days from discovery and bars unreasonable delay before that ³. The federal side is in our HIPAA notice rule explainer.
• Tax preparers, mortgage brokers, auto dealers and other non-bank lenders sit under the FTC Safeguards Rule: unencrypted data on at least 500 consumers means an FTC report within 30 days of discovery ⁴, and the rule also wants a WISP on file.

Since the 45-day bill has already passed one chamber, an in-house goal of letters out by day 45 costs little and keeps you ahead if it becomes law.

When a Michigan business finds a breach

If the attacker is still in, an insured Michigan company reports to its carrier before calling anyone else, files at ic3.gov so the FBI has it, and leaves machines as they are until they have been imaged ⁵⁶⁷.

A containment and forensics team, or your own IT support, then stops the intrusion and works out what was exposed. Group the people by home state, since the neighbors have fixed clocks Michigan lacks: Ohio and Wisconsin both allow 45 days. All the others are in our breach deadline table by state.

IC3 logged 22,191 complaints from Michiganders in 2025, with about $381 million in reported losses ⁸. Local support costs are compared in our Detroit and Grand Rapids guides, and insurer security checklists shows what carriers look at.

MCL 445.72 and the pending Senate bills were last checked on October 13, 2026. This page should not be taken as legal advice; a Michigan lawyer should confirm your duties, especially if those bills move.