Data Breach Notification Act

This act governs how entities that hold sensitive personally identifying information must protect that data and what they must do when it is compromised. It requires covered entities to maintain and assess reasonable security measures, to securely dispose of records containing such information, and to investigate suspected security breaches. When a breach warrants notice, the act sets out who must be told — affected individuals, the state attorney general, consumer reporting agencies, and the entities on whose behalf data is held — and provides exemptions for entities already subject to comparable federal or state regimes, along with consequences for failing to give required notice.

Editorial summary generated from the text of this act. It is not part of the statute — read the sections below for the operative language.