Pennsylvania Data Breach Notification Law

How the Pennsylvania data breach notification law works

The Pennsylvania breach notification law, the Breach of Personal Information Notification Act, requires notice to Pennsylvania residents when a breach exposes their unencrypted personal information ¹. It dates from 2005 (Act 94), but Act 33 of 2024 changed what a breach now costs a business ¹².

A breach counts only if it materially compromises the security or confidentiality of personal information and causes, or the business reasonably believes it has caused or will cause, loss or injury to a resident ¹. That test sits inside the definition itself. Pennsylvania does not ask you to write down a no-harm decision. Keep the facts behind it anyway, because the Attorney General may later ask why notice was not sent.

Beyond the standard elements, Pennsylvania covers health insurance information and online account credentials ¹. Medical information now counts only when a state agency or a state agency contractor holds it ².

A vendor that holds data for a business must tell the business, and the business notifies the residents ¹.

The Act 33 of 2024 changes

Act 33 of 2024 (Senate Bill 824) was signed June 28, 2024 and took effect September 26, 2024 ². It made three changes that matter to a business with a few thousand customer or employee records:

• Attorney General notice. When notice must go to more than 500 affected individuals in Pennsylvania, the Office of Attorney General must be notified at the same time ².
• A lower credit bureau trigger. The duty to notify the nationwide consumer reporting agencies now starts when more than 500 people are notified at one time, down from more than 1,000 ².
• Credit report and monitoring. In some breaches the business must pay for a credit report and a year of credit monitoring, covered below ².

The AG hears when your residents do, not before and not after, so draft the AG notice alongside the resident letter.

No fixed deadline, but the clock is real

Pennsylvania sets no number of days. Notice is due without unreasonable delay after the business determines the breach occurred, subject to any law enforcement delay and the time needed to find the scope of the breach ¹.

That flexibility is narrower than it looks. A breach that touches Pennsylvania usually touches neighbors too, and both Ohio and New York set fixed day limits for their residents. If your affected list crosses state lines, the shortest fixed deadline in the group sets the real schedule, and the Pennsylvania letters can go out with the rest. Our 50-state breach law table lists each one.

Free credit monitoring after some Pennsylvania breaches

Act 33 added a cost many small businesses do not expect. The duty applies when the business must notify the credit bureaus (more than 500 people at once) and a name was exposed together with a Social Security number, bank account number, driver's license number or state ID number ¹². The business must then pay for one independent credit report and 12 months of credit monitoring for the people affected ¹².

The bill text ties this duty to the credit bureau notice, which reads as applying only when more than 500 people are notified at one time ². Some summaries describe it without that limit. Until the point is settled, ask counsel before deciding not to offer monitoring in a smaller breach, and price it into the response either way. Your cyber policy may cover it, so check with the insurer.

Encryption, enforcement and who is already covered

Encrypted or redacted data is exempt unless it was taken in unencrypted form, the breach is linked to a breach of the encryption, or it involves a person with access to the encryption key ¹. Encrypted laptops and encrypted backups keep many incidents out of the law entirely.

A violation is treated as an unfair or deceptive act under the Unfair Trade Practices and Consumer Protection Law, and the Office of Attorney General has exclusive authority to bring that action ¹. The notice law does not give individuals their own right to sue.

Some businesses already answer to another rule. HIPAA-compliant entities are deemed compliant with the Pennsylvania law; see our HIPAA breach notification rule guide. Insurers covered by Pennsylvania's insurance data security law are exempt from the AG notice ¹².

The 500 line and your first steps

If the attack is still live, an insured Pennsylvania business reaches its carrier first, then lodges an FBI complaint through ic3.gov, and wipes nothing until evidence is saved ³⁶⁴. IC3 took 31,154 complaints from Pennsylvanians in 2025, covering about $538 million in reported losses ⁵.

Next:

1. Contain the attack and find what was taken, with your IT company or a dedicated forensic response firm.
2. Check the policy's rules on panel lawyers and forensic firms before hiring your own; common policy conditions explains them.
3. Count affected people by state, and separately count Pennsylvanians. The 500 line decides the AG notice, the credit bureau notice and possibly credit monitoring.
4. Fix the cause and write it into your security plan.

IT support pricing for Philadelphia and Pittsburgh is on our city pages.

We drew this summary from the 2005 act and the Act 33 bill text, last compared on October 13, 2026. It is general information rather than legal advice, so let a Pennsylvania lawyer confirm your obligations.