Wisconsin Data Breach Notification Law

The Wisconsin data breach notification law reaches past the state line

Wis. Stat. § 134.98 runs a 45-day limit from the day a business learns personal information was acquired, and asks for notice within a reasonable time before that ¹.

One Wisconsin rule goes further than most. A business based in Wisconsin, or one that keeps the data in Wisconsin, must notify every affected person, not only Wisconsin residents ¹. A Milwaukee company with customers in 20 states owes Wisconsin-law notice to all of them, on top of each state's own law.

Covered data includes the usual name with a Social Security or license number, and Wisconsin adds ¹:

• A financial account number on its own, with no access code needed
• A code or password that gives access to a financial account
• Biometric data and genetic data

The account-number rule is the one that catches small firms. A spreadsheet of customer bank account numbers for direct debits, with names attached, is covered even though no password or PIN went with it.

Who else is told: no state agency, credit bureaus at 1,000

No state agency, the Attorney General included, receives anything under this statute ¹. At 1,000 or more people notified, the consumer reporting agencies get word ¹.

GLBA businesses that comply with it and keep a breach policy are exempt ¹. Outside firms holding a client's data owe that client notice ¹.

A quiet state filing is not a quiet response. Illinois and Minnesota customers bring their own rules, and each state's requirement is in our table.

Exceptions, and why there is no penalty number

No notice is needed if the acquisition does not create a material risk of identity theft or fraud, and Wisconsin does not require that decision to be documented ¹. Encrypted, redacted or unreadable data elements are not covered, and the statute has no exception for a stolen key ¹.

The statute sets no penalty ¹. Failure to comply is not negligence or a breach of duty by itself, but it may be evidence of negligence ¹. The risk shows up in a lawsuit brought on other grounds rather than in a fine. The official statute's annotation reads the law as giving no private right to sue on its own, though the text itself is silent ¹.

If your Wisconsin business has a breach

During an active breach, a Wisconsin company with a cyber policy calls the carrier first, records the crime on the FBI's ic3.gov site, and leaves the affected systems alone until the evidence is copied ²⁵³. IC3 took in 16,680 complaints from Wisconsinites in 2025, totaling about $194 million in losses ⁴.

1. Contain the attack and keep the logs, adding a specialist response firm if your IT support needs help.
2. Hire the law firm the policy names, if it names one; cyber policy terms for small firms explains these clauses.
3. List every affected person. If you are based in Wisconsin, they all get Wisconsin notice, plus whatever their own state requires.
4. Calendar day 45 from when you learned of the acquisition.

Clinics carry a federal duty as well, set out in our HIPAA notice explainer. Milwaukee businesses can check local IT support pricing on our Milwaukee page.

Checked against § 134.98 on October 13, 2026. This guide describes the laws without offering legal advice; a Wisconsin-based business notifying people in other states should have counsel map how they overlap.