Wyoming Data Breach Notification Law

What the Wyoming data breach notification law covers

Wyo. Stat. §§ 40-12-501 to 40-12-502 hands the decision to an investigation that must be prompt and in good faith. Actual or reasonably likely misuse of personal identifying information means letters, sent in the most expedient time possible and without unreasonable delay ¹. A decision against notice need not be written down ¹.

The protected list is long ²:

• Online account credentials, and shared secrets or security tokens
• Medical and health insurance information, plus biometric data
• Taxpayer ID numbers, tribal ID cards and government-issued ID cards
• Birth and marriage certificates

Those entries pull in files most offices never think of as sensitive: the HR folder with a copy of a marriage certificate, or the scanned ID cards kept from onboarding.

Encryption: the gap in Wyoming's law

Encryption never appears in Wyoming's statute. Redaction is the one carve-out, defined as leaving no more than five digits accessible ¹².

So a stolen laptop with encrypted but unredacted files may still be in scope. The text does not settle it, and its redaction definition still cites subparagraphs that have since been repealed. Until the legislature or a court clears that up, do not treat encryption as a safe harbor here. It still helps: encrypted files make a finding of likely misuse less probable, and that finding is what triggers letters. Take the question to counsel.

What the notice must contain

Wyoming writes the letter's contents into the statute itself ¹. Each one needs:

• A toll-free number people can call to get contact details for the consumer reporting agencies
• The types of personal information involved
• A description of the breach
• The approximate date of the breach
• Advice to watch account statements and credit reports

Neither the Attorney General nor the bureaus receive anything ¹. Service providers holding a client's data must warn that client as soon as practicable, and GLBA financial institutions and HIPAA covered entities following their federal rules are deemed compliant ¹. A clinic will find the federal half in our patient breach notice explainer.

For violations, the Attorney General can sue in law or equity and recover damages; no penalty figure is set ¹. Because the statute calls its remedies non-exclusive while naming only the AG, a private suit is possible but untested.

Wyoming breach checklist

In a live incident, a Wyoming firm with cyber coverage calls the carrier's claims line before anything else, reports to the FBI's IC3 online, and copies evidence before any cleanup starts ³⁵⁴.

1. Once the attack is contained, run the good faith investigation with a response specialist or your outsourced IT team.
2. Hire the lawyers and forensic firm the policy names; carrier conditions in plain terms explains why.
3. Get the toll-free line working before letters are mailed.
4. Group people by home state. Colorado and Montana apply their own laws to their residents, and the breach rules for every state cover everyone else.

Afterward, record the fixes in your WISP.

The Wyoming statute was compared with this page on October 13, 2026. No summary can settle the encryption gap above, and none of this is legal advice, so take that question to counsel.