Montana Data Breach Notification Law

The Montana data breach notification law: residents and the AG together

Mont. Code Ann. §§ 30-14-1701 to 30-14-1705, unchanged since 2015, measures time by the phrase without unreasonable delay, leaving room for a police hold and for scoping the incident and repairing systems ¹.

The state copy is easy to prepare and easy to send late. Any time residents get letters, the Office of Consumer Protection must simultaneously receive an electronic copy plus a note of the date and method of distribution ¹, with no personal identifying information in it and no minimum headcount. A copy mailed weeks after the letters misses the word "simultaneously"; send both the same day.

Credit bureaus: coordination, not notice

No bureau notice exists in Montana. What the statute has is a coordination duty: a letter that tells residents they can obtain a credit report obliges the business to work out its timing, content and distribution with the credit bureau ¹. If your template carries that sentence, call the bureaus before mailing. Build that call into the schedule rather than deleting the sentence, since the credit report pointer is one of the more useful lines a resident will read.

Montana's harm test and covered data

An incident qualifies only when it materially compromises personal information and causes, or is reasonably believed to cause, loss or injury to a Montana resident ¹. Deciding it does not qualify needs no written record and no Attorney General filing.

Encrypted information is outside the law, and a stolen key is not addressed ¹. The protected list adds medical information, taxpayer ID numbers, IRS identity protection PINs and tribal ID card numbers to the basics, which puts payroll and tax files at the center of the risk for bookkeepers, CPAs and employers. Encrypting laptops, backups and shared drives keeps many incidents out entirely; security basics for small offices walks through it.

A vendor holding a client's records owes that client notice immediately. Following your own notice procedures, if consistent with the statute, counts as compliance ¹.

Montana fines and the unfair trade practice route

The Department of Justice can ask a court for an injunction, and a violation doubles as an unfair trade practice under § 30-14-103 ², finable at up to $10,000 per willful violation ³.

No lawsuit is written into the breach statute. Montana's broader consumer protection law does let a consumer who lost money or property sue individually, though not as a class, over unfair trade practices; whether that reaches a missing breach letter is for counsel to judge.

Sending Montana's notices together

With an intruder still connected, a Montana firm that carries cyber coverage phones the carrier first, then lodges a complaint at ic3.gov, and copies the evidence before restoring a single file ⁴⁵⁶.

Your IT contractor or a forensic response firm then contains the incident and finds what left. Group people by home state: North Dakota has no harm exception, and Idaho requires no state filing at all; every other state's rule is in our table. Assemble the Office of Consumer Protection copy alongside the letters so they leave together, and review carrier requirements for small businesses before the claim call.

Title 30, Chapter 14 was last compared with this summary on October 13, 2026. General information only, never legal advice; a Montana lawyer can confirm what applies.