Missouri Data Breach Notification Law

How the Missouri data breach notification law sets the timing

RSMo 407.1500, on the books since August 28, 2009, runs the clock from the moment a business finds the breach or hears of it from someone else, and asks only that consumers be told without unreasonable delay ¹.

That phrase still has teeth. Once you know who was hit and what was taken, every idle week is harder to explain. Firms near the state line often hold records on Kansans and Illinoisans as well, and the strictest of those states' rules may end up setting your real schedule.

Above 1,000: the Attorney General and every bureau

Both outside reports hinge on one number. Notify more than 1,000 consumers at one time and the Attorney General's office plus each consumer reporting agency must learn, without unreasonable delay, the timing, distribution and content of your letters ¹. A mailing of 1,000 or fewer needs neither report under this statute.

Because the statute measures people notified "at one time," keep the mailing logs and a note of how the count was built.

Outside firms that hold a client's records, such as a hosting or billing company, must alert that client immediately after discovering a breach ¹. A police request to hold off on letters has to be in writing or written up by you; the statute says so ¹.

Data types Missouri adds to the usual list

Missouri's list reaches past name plus Social Security number to three more items ¹:

• Medical information and health insurance information
• Other government-issued ID numbers
• A unique electronic identifier or routing code combined with the access code needed to use it

Encrypted, redacted or otherwise unreadable or unusable records are exempt ¹. The text never addresses a stolen key, so treat the exemption as doubtful whenever the key may have gone with the files.

The no-harm exception and its paper trail

Letters can be skipped where an appropriate investigation, or a talk with law enforcement, leads the business to decide identity theft or other fraud is not reasonably likely ¹. Missouri wants that conclusion in writing and on file for five years.

Missouri also treats some businesses as compliant without following the statute line by line: those that follow their own consistent notice policy, or the breach procedures of their federal or state regulator ¹. A bank or health care practice may meet Missouri's rule this way, so write the policy down before you need it.

Penalties: the Attorney General acts alone

Enforcement belongs to the Attorney General alone, with exclusive authority to recover actual damages for a willful and knowing violation and a civil penalty of up to $150,000 per breach or series of similar breaches found in a single investigation ¹. A consumer cannot bring a suit under this section.

Missourians filed 14,087 cybercrime complaints with IC3 in 2025 and reported roughly $234 million lost ².

Handling a breach at a Missouri business

During a live attack, a Missouri company with cyber coverage reports the claim to its carrier before calling anyone else, records the crime with IC3, the FBI's reporting site, and does not touch the affected machines until evidence has been copied ³⁴⁵.

The response team, or your usual IT support for a small incident, then contains the intrusion and works out what was copied. Split the list by home state, because Kansas and Illinois residents bring their own laws, and the state-by-state notice table has the rest. Policy fine print is covered in carrier security requirements, and controls that keep a small firm's breach small covers prevention. Our Kansas City and St. Louis guides explain what local IT support costs and includes.

Our last comparison of this page with RSMo 407.1500 was on October 13, 2026. Read it as background rather than legal advice, and ask a Missouri attorney to apply it to your situation.