Data Breach Notification Laws by State — Who Must Be Told, and How Fast, in All 50 States

“(g)(1) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider for which a consumer accessed the services of the insurer through an independent insurance producer, and for which consumer notice is required by the Alabama Data Breach Notification Act of 2018, Chapter 38 of Title 8, the insurer shall notify the producers of record of all affected …”

“(d) In addition to the requirements of this section, a licensee shall comply with all applicable provisions of AS 45.48 (Alaska Personal Information Protection Act). If a licensee is required to notify the director of a cybersecurity event under (a) of this section and is also required to provide notice under AS 45.48, the licensee shall provide to the director a copy of the notice sent to consumers under AS 45.48.”

“C. A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee. The person that maintains the data under an agreement with the owner or …”

“(1) Any person or business that acquires, owns, or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of Arkansas whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.”

“(a) Any agency that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired …”

“(I) Any notification required by law concerning a data or other security breach; and”

“(b) (1) Any person who owns, licenses or maintains computerized data that includes personal information, shall provide notice of any breach of security following the discovery of the breach to any resident of this state whose personal information was breached or is reasonably believed to have been breached. Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal …”

“b. A licensee has a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner regarding material changes to previously-provided information relating to a cybersecurity event.”

“(1) “Breach of the security of the system” means unauthorized acquisition of computerized or other electronic data, or any equipment or device storing such data, that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. The term “breach of the security system” shall not include a good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or …”

“(a) “Breach of security” or “breach” means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of the covered entity does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use.”

“(a) Any information broker or data collector that maintains computerized data that includes personal information of individuals shall give notice of any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The notice shall be made in the most expedient time …”

“(a) Any business that owns or licenses personal information of residents of Hawaii, any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise), or any government agency that collects personal information for specific government purposes shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach. The disclosure …”

“(12) Before a resident shall have standing to file an action under this section, he or she must give his or her landlord three (3) days’ written notice, listing each failure or breach upon which his action will be premised and written demand requiring performance or cure. If, within three (3) days after service of the notice, any listed failure or breach has not been performed or cured by the landlord, the resident may proceed to commence an action for damages and …”

“An operator shall do the following: (1) Implement and maintain reasonable security procedures and practices that otherwise meet or exceed industry standards designed to protect covered information from unauthorized access, destruction, use, modification, or disclosure. (2) Delete, within a reasonable time period, a student's covered information if the school or school district requests deletion of covered information under the control of the school or school district, …”

“(w) The department may share a taxpayer's name and other personal identification information with a tax preparer or tax preparation software provider in cases where the department suspects that a fraudulent return has been filed on behalf of a taxpayer and the department suspects that the system of a taxpayer's previous year tax preparer or tax preparation software provider has been breached.”

“1. Any person who owns or licenses computerized data that includes a consumer’s personal information that is used in the course of the person’s business, vocation, occupation, or volunteer activities and that was subject to a breach of security shall give notice of the breach of security following discovery of such breach of security, or receipt of notification under subsection 2, to any consumer whose personal information was included in the information that was …”

“(a) Every applicant for a public warehouse license upon notification by the secretary of the amount of bond or letter of credit required, shall promptly file with the secretary a bond with good corporate surety qualified under the laws of the state of Kansas or letter of credit pursuant to subsection (d). The amount of the bond or letter of credit to be furnished for each warehouse shall be $.20 per bushel for the first 1,000,000 bushels of licensed capacity; $.15 per …”

“(b) Individuals may be nominated by the retirement system members which are to elect the trustee by presenting to the executive director, not less than four (4) months before a term of office of a trustee is due to expire, a petition, bearing the name, last four (4) digits of the Social Security number, and signature of no less than one-tenth (1/10) of the number voting in the last election by the retirement system members.”

“A. The legislature hereby declares that all personally identifiable information is protected as a right to privacy under the Constitution of Louisiana and the Constitution of the United States.”

“1-B. Residential lease without termination or notice language. If a written residential lease or contract does not include a provision to terminate the tenancy or does not provide for any written notice of termination in the event of a material breach of a provision of the written residential lease or contract, either the landlord or the tenant may terminate the written residential lease or contract pursuant to this subsection.”

“(a) (1) A credit grantor may repossess tangible personal property securing a loan under an agreement, note, or other evidence of the loan if the consumer borrower is in default.”

“(h) Any owner undertaking to abate or contain dangerous levels of lead in any dwelling unit may, at the owner's option, reasonably delay the commencement of the tenancy until a letter of compliance or interim control certificate has been issued; provided, that no duly executed lease exists between owner and tenant; and provided, further, that no such delay shall exceed thirty days. During any such period of delay of occupancy the prospective tenant shall bear any living …”

“(2) Unless the person or agency determines that the security breach has not or is not likely to cause substantial loss or injury to, or result in identity theft with respect to, 1 or more residents of this state, a person or agency that maintains a database that includes data that the person or agency does not own or license that discovers a breach of the security of the database shall provide a notice to the owner or licensor of the information of the security breach.”

“Whenever there is a breach of the security of the system of a person or entity that has violated this section, or that person's or entity's service provider, that person or entity shall reimburse the financial institution that issued any access devices affected by the breach for the costs of reasonable actions undertaken by the financial institution as a result of the breach in order to protect the information of its cardholders or to continue to provide services to …”

“(11) Any person who conducts business in this state that maintains its own security breach procedures as part of an information security policy for the treatment of personal information, and otherwise complies with the timing requirements of this section, shall be deemed to be in compliance with the security breach notification requirements of this section if the person notifies affected individuals in accordance with the person’s policies in the event of a breach of …”

“2. (1) Any person that owns or licenses personal information of residents of Missouri or any person that conducts business in Missouri that owns or licenses personal information in any form of a resident of Missouri shall provide notice to the affected consumer that there has been a breach of security following discovery or notification of the breach. The disclosure notification shall be:”

“(1) (a) Upon discovery or notification of a breach of the security of a data system, a state agency that maintains computerized data containing personal information in the data system shall make reasonable efforts to notify any person whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.”

“(1) A licensee shall notify the director through the Nationwide Mortgage Licensing System and Registry at least thirty days prior to the occurrence of any change of the licensee's name, trade name, or doing business as designation. (2)(a) Except as provided in subdivisions (b) and (c) of this subsection, a licensee shall notify the director in writing or through the Nationwide Mortgage Licensing System and Registry within three business days from the time that the …”

“1. A person who holds a security interest in a unit must provide the association with the person’s contact information as soon as reasonably practicable, but not later than 30 days after the person:”

“(c) If a person convicted of any offense of cruelty to animals appeals the conviction in an initial de novo or subsequent appeal and any confiscated animal remains in the custody of the arresting officer, the arresting officer's agency, or the arresting officer's agency's designee pending disposition of the appeal, in order for the defendant or appellant to maintain a future interest in the animal, the trial or appellate court, after consideration of the income of the …”

“12. a. Any business that conducts business in New Jersey, or any public entity that compiles or maintains computerized records that include personal information, shall disclose any breach of security of those computerized records following discovery or notification of the breach to any customer who is a resident of New Jersey whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person. The disclosure to a customer shall be …”

“A. Except as provided in the Uniform Owner-Resident Relations Act, if there is noncompliance with Section 47-8-22 NMSA 1978 materially affecting health and safety or upon the initial material noncompliance by the resident with the rental agreement or any separate agreement, the owner shall deliver a written notice to the resident specifying the acts and omissions constituting the breach, including the dates and specific facts describing the nature of the alleged breach, …”

“§ 2-d. Unauthorized release of personally identifiable information. 1.\nDefinitions. As used in this section the following terms shall have the\nfollowing meanings:\n a. "Building principal" means a building principal subject to annual\nperformance evaluation review under the provisions of section three\nthousand twelve-c, section three thousand twelve-d, or section three\nthousand twelve-e of this chapter.\n b. "Classroom teacher" means a teacher subject to annual …”

“(1) The social security number can be used as a tool to perpetuate fraud against a person and to acquire sensitive personal, financial, medical, and familial information, the release of which could cause great financial or personal harm to an individual. While the social security number was intended to be used solely for the administration of the federal Social Security System, over time this unique numeric identifier has been used extensively for identity verification …”

“(5) A general description of the notification event; and (6) A statement whether any law enforcement official has provided the financial corporation with a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the commissioner to contact the law enforcement official. A law enforcement official may request an initial delay of up to forty-five days following the date when …”

“(ii) At any time prior to the date the application for exemption is approved, a felony involving an act of fraud, dishonesty, a breach of trust, theft, or money laundering.”

“A. An individual or entity that owns or licenses computerized data that includes personal information shall provide notice of any breach of the security of the system following determination or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity …”

“(jj)(A) “Security interest” means an interest in personal property or fixtures which secures payment or performance of an obligation. “Security interest” includes any interest of a consignor and a buyer of accounts, chattel paper, a payment intangible or a promissory note in a transaction that is subject to ORS chapter 79A.”

“(1) In the case of a cybersecurity event involving nonpublic information that is used by a licensee, which is acting as an assuming insurer, or that is in the possession, custody or control of a licensee, which is acting as an assuming insurer and which does not have a direct contractual relationship with the affected consumers, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making …”

“(a)(1) Any municipal agency, state agency, or person who or that stores, owns, collects, processes, maintains, acquires, uses, or licenses data that includes personal information shall provide notification as set forth in this section of any disclosure of personal information, or any breach of the security of the system, that poses a significant risk of identity theft to any resident of Rhode Island whose personal information was, or is reasonably believed to have been, …”

“(B) The applicant must post a ten thousand dollar bond with SLED in a form approved by the Attorney General in favor of the State. The bond must be issued by a surety insurer licensed to transact surety insurance in this State. The surety on the bond may cancel the bond upon giving thirty days' notice to SLED and is relieved of liability for a breach of condition after the effective date of cancellation.”

“Following the discovery by or notification to an information holder of a breach of system security an information holder shall disclose in accordance with § 22-40-22 the breach of system security to any resident of this state whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person. A disclosure under this section shall be made not later than sixty days from the discovery or notification of the breach of …”

“(11) Following discovery or notification of a breach of system security by an information holder, the information holder shall disclose the breach of system security to any resident of this state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made no later than forty-five (45) days from the discovery or notification of the breach of system security, unless a longer period of time is …”

“(b) A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made without unreasonable delay and in each case not later than the 60th day …”

“(b) If a person maintains the person's own notification procedures as part of an information security policy for the treatment of personal information the person is considered to be in compliance with the notification requirement in Subsection (1)(b) if the procedures are otherwise consistent with this chapter's timing requirements and the person notifies each affected Utah resident in accordance with the person's information security policy in the event of a breach.”

“(A) any notification required by law concerning a data or other security breach; and”

“(15) "Consumer" means an individual who is a licensee of information or informational rights that the individual at the time of contracting intended to be used primarily for personal, family, or household purposes. The term does not include an individual who is a licensee primarily for professional or commercial purposes, including agriculture, business management, and investment management other than management of the individual's personal or family investments.”

“(b) "Breach" has the same meaning as "breach of the security of the system" in RCW 19.255.010.”

“(a) Every nonresident bail bond enforcer or bail bondsman, for the privilege of entering this state to act in the capacity of a bail bond enforcer, either personally or through an agent, appoints the Secretary of State, or his or her successor in office, to be his or her agent or attorney-in-fact upon whom may be served all lawful process in any action or proceeding against him or her in any court of record in this state for any act occurring within this state resulting …”

“(a) 3. and, no sooner than 15 days after the merchant gives the notice specified in s. 425.205 (1g) (a), the merchant has taken possession of the collateral or goods in accordance with sub. (2).”

“(g) Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity for which the information is maintained any breach of the security of the system as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The person who maintains the data on behalf of another …”