Insurance Data Security Act

The Insurance Data Security Act governs how entities licensed by the state insurance commissioner safeguard the information they hold and how they must respond when that information or their systems are compromised. It requires licensees to maintain an information security program, to address security in their arrangements with third-party service providers, and to investigate cybersecurity events, including those originating with a service provider. It further establishes notification duties — to the commissioner, to affected consumers, and between insurers, reinsurers, and producers of record — together with confidentiality protections for information supplied to the commissioner and the commissioner's authority to adopt rules, enforce the act, and impose penalties.

Editorial summary generated from the text of this act. It is not part of the statute — read the sections below for the operative language.