Data Breach Notice to Residents and State Authorities by State
When a private entity discovers or determines a breach involving residents' personal information, who must it notify, by when, by what method and with what content, and what statutory delay or exception applies?
Jurisdictions
All 51 verified
Statutes checked
Every entry, oldest check October 14, 2026
Columns
10 per state
Access
Free, no account needed
What the table covers
State breach-notification laws specify when an entity holding personal information must tell affected people, a state authority, or consumer-reporting agencies about a breach. The table separates those recipients and their clocks because a single incident can start more than one duty.
Why the columns differ
Texas § 521.053(b), (i) requires individual disclosure “not later than the 60th day” after breach determination and attorney-general notice “not later than the 30th day” if at least 250 Texas residents are involved. Florida § 501.171(3)(a), (4)(a) uses a 500-person threshold for the Department of Legal Affairs and a 30-day individual clock. Washington RCW 19.255.010(1), (7) allows no individual notice when a breach “is not reasonably likely to subject consumers to a risk of harm,” yet requires attorney-general notice for more than 500 Washington residents within 30 days after discovery. Those differences make the trigger, threshold, and start date separate columns.
Patterns across the finished table
The usual structure separates the data holder’s notice to people from a service provider’s notice to the holder. States set materially different triggers: some require unauthorized acquisition, some include access, and some permit a documented harm or misuse screen. Oregon §§ 646A.602 and 646A.604 uses unauthorized acquisition, a written unlikely-harm decision, a 10-day vendor clock and a 45-day covered-entity clock. A state's clock may begin on discovery, determination, confirmation or notice from a vendor, so the number of days alone does not describe the rule.
Regulator notice is a separate duty, often triggered at a resident count; Maryland and Nebraska have broader report routes, while Nevada's general act has no attorney-general report. Consumer-reporting-agency notice can have another threshold. Substitute notice also varies by cost, affected population, missing contact details and whether website and media channels must be combined. Some sectoral compliance routes replace the general notice procedure but preserve a state-agency copy duty, as Oregon's § 646A.604(10) illustrates.
Scope boundaries
The table addresses the general state notice duty of a private entity and its service provider. A particular incident may also engage sector-specific or federal law. General security programs, damages actions, and incident-response decisions remain outside this comparison.
State by state
Every column answered the same way for each jurisdiction. Open a state for the full page, with the statute text and the date it was checked.
Scroll sideways in the table to see all columns →
| State | Covered entity and service provider | Breach and covered information | Risk screen or notice exception | Individuals who receive notice | Individual notice deadline and clock | Regulator threshold and deadline | Consumer-reporting-agency notice | Individual delivery and content | Substitute notice conditions and channels | Delays and alternate compliance |
|---|---|---|---|---|---|---|---|---|---|---|
| Alabama verified 2026-10-14 | Covered entity acquiring/using SPII notifies individuals; third-party agent notifies entity expeditiously, within 10 days after determination or reason to believe breach (§§ 8-38-2(2),(7), 8-38-8) |
Unauthorized acquisition of electronic SPII; name plus IDs, financial, medical/insurance or qualifying online credentials; key compromise defeats encryption (§ 8-38-2(1),(3),(6)) |
Prompt good-faith investigation; notice if acquisition reasonably likely substantial harm; written no-notice determination retained at least 5 years (§§ 8-38-4, 8-38-5(a),(f)) |
Affected AL residents whose SPII was or is reasonably believed acquired and reasonably likely to cause substantial harm (§§ 8-38-2(5), 8-38-5(a)) |
Expeditiously, without unreasonable delay; within 45 days after qualifying entity determination or receipt of agent breach notice (§ 8-38-5(b)) |
More than 1,000 individuals require notice: written AG report expeditiously, within same 45-day trigger clock, with incident, count, services and contact (§ 8-38-6(a)-(b)) |
More than 1,000 people require notice at one time: all nationwide agencies without unreasonable delay; timing, distribution, content (§ 8-38-7) |
Mail or email; date/range, acquired SPII, restoration and self-protection steps, entity contact (§ 8-38-5(d)) |
Direct notice infeasible due to relative/excessive cost, >$500,000, >100,000 people, or missing contacts: 30-day website if maintained AND print/broadcast media (§ 8-38-5(e)) |
Written law-enforcement request delays for investigation/security; qualifying federal or state regulatory procedures exempt with individual notice and AG copy above 1,000 (§§ 8-38-5(c), 8-38-11–12) |
| Alaska verified 2026-10-14 | Covered person owning/licensing resident PI gives resident notice; nonowner recipient immediately tells owner/licensee and cooperates (§§ 45.48.010(a), .070, .090(2),(4)–(6)) |
Actual/reasonably believed unauthorized acquisition compromising PI, including paper; unencrypted/unredacted name plus listed ID or financial data, or encrypted data with exposed key (§ 45.48.090(1),(7)) |
After appropriate investigation, written AG notice and written five-year record, no resident notice if harm not reasonably likely; good-faith employee/agent exception (§§ 45.48.010(c), .050) |
Each Alaska resident whose PI was subject to breach; distributor handles resident notice after nonowner recipient reports incident (§§ 45.48.010(a), .070) |
As expeditiously as possible without unreasonable delay after discovery/notification, allowing scope and integrity work; no fixed day ceiling (§ 45.48.010(a)–(b)) |
Written AG notice precedes any no-harm decision excusing resident notice; §§ 45.48.010–.090 give no general numerical AG breach-report threshold or fixed deadline (§ 45.48.010(c)) |
If resident notice required for >1,000 Alaska residents, notify all nationwide consumer credit reporting agencies without unreasonable delay; give timing, distribution and content, not names; GLBA exception (§ 45.48.040) |
Mail to most recent address; qualifying electronic notice; eligible substitute; §§ 45.48.010–.030 prescribe no separate resident-letter content list (§ 45.48.030) |
Cost >$150,000, affected Alaska class >300,000, or insufficient contact; use available email AND website posting if maintained AND major statewide media (§ 45.48.030(3)) |
Law-enforcement determination of interference permits delay; resume expeditiously without unreasonable delay after written clearance. No waiver of §§ 45.48.010–.090 is enforceable (§§ 45.48.020, .060) |
| Arizona verified 2026-10-14 | AZ business owner/licensee: resident and conditional agency notice; nonowner maintainer: prompt owner notice and cooperation (§ 18-552(A)-(C)) |
Unauthorized access AND acquisition materially compromising unencrypted/unredacted computerized data; name/data or online credentials (§§ 18-551(1), (7), (11), 18-552(A)) |
After reasonable investigation, no notice if no substantial economic loss resulted or is reasonably likely; good-faith employee exclusion (§§ 18-551(1), 18-552(J)) |
Affected AZ residents with in-state principal mailing address in records at breach time (§§ 18-551(4), 18-552(B)(1)) |
Within 45 days after breach determination; after law-enforcement clearance, within 45 days (§ 18-552(B), (D)) |
More than 1,000 notices: AG AND AZ Department of Homeland Security in writing within 45 days after determination (§ 18-552(B)(2)) |
More than 1,000 notices: three largest nationwide agencies within 45 days after determination (§§ 18-551(5), 18-552(B)(2)(a)) |
Writing, email if available, or live phone; approximate date, data description, three-agency and federal identity-theft contacts (§ 18-552(E)-(F)) |
Cost over $50,000, over 100,000 recipients, or insufficient contact: AG justification letter AND website post for 45 days if site exists (§ 18-552(F)(4)) |
Agency-advised criminal-investigation delay; consistent own-policy or federal-regulator route; specified GLBA/HIPAA exclusions (§ 18-552(D), (H)-(I), (N)) |
| Arkansas verified 2026-10-14 | Acquirer, owner, or licensee of computerized PI notifies residents; nonowner maintainer tells owner/licensee immediately after discovery (§ 4-110-105(a)-(b)) |
Unauthorized acquisition of computerized PI compromising security/confidentiality/integrity; name plus SSN, Arkansas ID, financial access, medical information, or biometric data (§ 4-110-103(1),(7)) |
No notice after reasonable investigation finds no reasonable likelihood of customer harm; good-faith employee acquisition excluded absent misuse/disclosure (§§ 4-110-103(1), 4-110-105(d)) |
Arkansas residents whose unencrypted PI was or reasonably is believed acquired by an unauthorized person (§ 4-110-105(a)(1)) |
Most expedient time and manner possible without unreasonable delay after discovery/notification; scope and restoration work allowed; no fixed outer day limit (§ 4-110-105(a)(2)) |
More than 1,000 affected individuals; § 105(b)(2) refers to nonowner-holder (b)(1); AG by affected-person disclosure or 45 days after reasonable-harm determination, whichever first (§ 4-110-105(b)(2)) |
No separate nationwide consumer-reporting-agency notice in § 4-110-105; the extra statutory recipient is the AG under (b)(2) (§ 4-110-105(a)-(g)) |
Written or qualifying email notice; § 4-110-105 does not enumerate required resident-letter contents (§ 4-110-105(a),(e)) |
Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 4-110-105(e)(3)) |
Law-enforcement impediment until clearance; timely own-policy or qualifying stronger state/federal law; written determination/support kept five years and produced to AG within 30 days on written request (§§ 4-110-105(c),(f)-(g), 4-110-106) |
| California verified 2026-10-14 | CA business or individual owning/licensing computerized personal information notifies residents; nonowner custodian notifies owner/licensee immediately (§ 1798.82(a)-(b)) |
Unauthorized acquisition of covered data; name plus listed identifiers, health, biometric, plate, or genetic data, or account credentials; encrypted data counts if usable key/credential acquired (§ 1798.82(a), (g)-(k)) |
Actual or reasonably believed unauthorized acquisition governs; § 1798.82(a), (g) states no separate risk-of-harm waiver |
California resident whose covered unencrypted data, or encrypted data with usable key/credential, was or is reasonably believed acquired (§ 1798.82(a)(1)) |
Within 30 calendar days after discovery or notice of breach; law-enforcement or necessary scope/restoration delay can extend it (§ 1798.82(a)(2), (c)) |
More than 500 California residents from one breach: electronically send AG one redacted sample of resident notice within 15 calendar days after notifying residents (§ 1798.82(f)) |
No separate agency submission under § 1798.82; resident notice must give major agencies' toll-free numbers and addresses if SSN, driver license, or CA ID exposed (§ 1798.82(d)(2)(F)) |
Written or E-SIGN electronic notice; plain-language titled notice, named headings, ≥10-point type, sender/contact, data types, available dates and incident facts, plus conditional credit-agency and mitigation items (§ 1798.82(d), (j)) |
Cost over $250,000, more than 500,000 people, or insufficient contacts; all applicable email, conspicuous website posting for ≥30 days, and statewide media (§ 1798.82(j)(3)) |
Police delay until investigation safe; necessary scope/restoration delay; compliant own-policy method; HIPAA/HITECH compliance substitutes for notice-content subdivision only (§ 1798.82(a)(2), (c), (e), (l)) |
| Colorado verified 2026-10-14 | Business owner/licensee/maintainer notifies residents; contracted processor promptly notifies and cooperates with owner if misuse occurred or likely (§ 6-1-716(1)(b),(i), (2)(a),(b)) |
Unauthorized acquisition of unencrypted computerized PI; name with listed IDs, medical/insurance or biometric data, or online credentials or financial access; key compromise counts (§ 6-1-716(1)(g)-(h), (2)(a.4)) |
Good-faith prompt investigation; no notice if misuse has not occurred and is not reasonably likely; good-faith employee acquisition excluded (§ 6-1-716(1)(h), (2)(a)) |
Affected Colorado residents whose PI was acquired, unless investigation supports no-misuse finding (§ 6-1-716(2)(a)) |
Most expedient time, without unreasonable delay; no later than 30 days after breach determination, subject to police/scope/system needs (§ 6-1-716(2)(a),(c)) |
500+ CO residents reasonably believed affected: AG within 30 days after breach determination, unless no misuse occurred or likely (§ 6-1-716(2)(f)(I)) |
More than 1,000 CO residents to be notified: all nationwide agencies, expeditiously without unreasonable delay; anticipated resident date and approximate count (§ 6-1-716(2)(d)) |
Mail, phone, or qualifying electronic notice; incident date/range, acquired PI, entity and credit-agency/FTC contacts, fraud-alert/freezes statement (§ 6-1-716(1)(f), (2)(a.2)) |
Cost over $250,000, class over 250,000 CO residents, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 6-1-716(1)(f)(IV)) |
Police impediment delay; notice within 30 days after clearance; own-policy/regulator procedures may suffice but AG report still required (§ 6-1-716(2)(c), (3)) |
| Connecticut verified 2026-10-14 | Owner, licensee, or maintainer of computerized PI notifies residents; nonowner maintainer also tells owner/licensee immediately after discovery (§ 36a-701b(b)(1),(c)) |
Unauthorized access OR acquisition of unsecured electronic PI; name plus listed ID, financial, health, biometric, or geolocation data, or online credentials (§ 36a-701b(a)) |
No resident notice after appropriate investigation reasonably finds harm unlikely; public information excluded from PI (§ 36a-701b(a)(2),(b)(1)) |
CT residents whose PI was or reasonably is believed breached; later identified residents notified as expediently as possible (§ 36a-701b(b)(1)) |
Without unreasonable delay, no later than 60 days after discovery, subject to shorter federal limit or police delay (§ 36a-701b(b)(1),(d)) |
AG whenever resident notice required, no later than resident notice; no population threshold; substitute trigger demonstrated in AG notice (§ 36a-701b(b)(2)(A),(e)(4)) |
No separate nationwide consumer-reporting-agency report in § 36a-701b; SSN or taxpayer-ID breach instead triggers at least two years of free identity-theft services (§ 36a-701b(b)(2)(B)) |
Writing, telephone, qualifying electronic notice; credential breach may use password-reset directions, with special rule for compromised email accounts (§ 36a-701b(e)-(f)) |
Cost over $250,000, affected class over 500,000, or insufficient contacts: email where available AND website if maintained AND major statewide media (§ 36a-701b(e)(4)) |
Requested law-enforcement delay until clearance; timely own-policy, regulator-policy, or HIPAA/HITECH routes retain applicable AG notice (§ 36a-701b(d),(g)-(h)) |
| Delaware verified 2026-10-14 | DE-doing-business owner/licensee of computerized PI tells residents; nonowner holder tells and cooperates with owner/licensee immediately after breach determination (§ 12B-102(a)-(b)) |
Unauthorized acquisition of computerized PI compromising security/confidentiality/integrity; encrypted data counts if key acquired/likely acquired and owner reasonably believes readable; listed identifiers include passport, online credentials, medical, biometric, tax ID (§ 12B-101(1),(7)) |
After appropriate investigation, owner may withhold notice on reasonable finding harm unlikely; good-faith employee acquisition excluded absent unauthorized use/disclosure (§§ 12B-101(1)a., 12B-102(a)) |
DE resident whose PI was or reasonably believed breached; email-account credential breach has special delivery restriction; nonowner holder tells owner/licensee (§ 12B-102(a),(b),(f)) |
Without unreasonable delay, not later than 60 days after breach determination; shorter federal deadline, law-enforcement delay, and reasonable-diligence late identification routes stated (§ 12B-102(c)) |
>500 DE residents to notify: AG by resident-notice time. If certain residents unidentified within 60 days despite diligence: AG within 60 days unless qualifying substitute notice given by then (§ 12B-102(c)(3),(d)) |
No general bureau notice in chapter 12B; SSN breach instead requires one year of free credit monitoring and freeze information unless harm reasonably unlikely (§ 12B-102(e)) |
Writing, phone, qualifying E-SIGN/primary-channel email, or eligible substitute; email-account login breach cannot be noticed to compromised address, may use usual account login screen. SSN route adds monitoring/freeze information (§§ 12B-101(5), 12B-102(e)-(f)) |
Cost >$75,000, >100,000 DE residents, or insufficient contact; all available email, website posting if maintained, statewide media plus major social platforms, AND AG notice (§ 12B-101(5)d.) |
Law-enforcement criminal-investigation request pauses notice until clearance; shorter federal clock controls. Own policy route keeps chapter timing; regulator rules route deemed compliant with § 12B-102(c) when followed (§§ 12B-102(c)(1)-(2), 12B-103) |
| District of Columbia verified 2026-10-14 | Person/entity doing business in DC owning/licensing electronic PI gives resident notice; nonowner holder tells owner/licensee as expeditiously as possible (§§ 28-3851(2A), 28-3852(a),(b)) |
Unauthorized acquisition of electronic data/device compromising PI; identifiers plus government, financial, medical, genetic, insurance, biometric data, or credential combinations (§ 28-3851(1),(3)) |
Excludes secure unusable data unless protection compromised; good-faith employee acquisition; likely-no-harm decision requires reasonable investigation and AG/federal-law-enforcement consultation (§ 28-3851(1)(B)) |
DC residents whose personal information was included in breach; owner/licensee receives nonowner holder report (§ 28-3852(a),(b)) |
Promptly after discovery, in most expedient time possible without unreasonable delay, allowing investigation, restoration and law-enforcement needs; no fixed outer day limit (§ 28-3852(a),(d)) |
At least 50 DC residents affected: written OAG notice promptly, without unreasonable delay and no later than resident notice; report 11 listed incident details/sample (§ 28-3852(b-1),(b-2)) |
More than 1,000 persons to notify under owner/holder duties: nationwide agencies receive timing, distribution and content without unreasonable delay, not names; GLBA exception (§ 28-3852(c)) |
Written or consented E-SIGN electronic notice; describe compromised categories and give business, reporting agency, FTC and DC OAG contacts plus security-freeze information; special credentials-only route (§§ 28-3851(2), 28-3852(a-1),(a-2)) |
Cost >$50,000, recipients >100,000, or insufficient contact; available email AND website posting if maintained AND major local and applicable national media (§ 28-3851(2)(C)) |
Law-enforcement finding of criminal-investigation impediment permits delay until clearance; specified GLBA/HIPAA/HITECH resident notices may comply, but OAG notice still applies at 50 (§ 28-3852(d),(g)) |
| Florida verified 2026-10-14 | Commercial covered entity acquiring, keeping, or using personal information; contracted third-party agent tells entity as soon as practicable and ≤10 days after determination/reason (§ 501.171(1)(b),(h), (6)) |
Unauthorized access to electronic data with personal information; name plus listed identifiers, health, biometric or geolocation data, or online credentials; publicly available or unusable encrypted data excluded (§ 501.171(1)) |
No individual notice after appropriate investigation and law-enforcement consultation finds no likely identity theft/financial harm; document 5 years and send determination to department within 30 days (§ 501.171(4)(c)) |
Each person in Florida whose personal information was or is reasonably believed accessed in the breach (§ 501.171(4)(a)) |
As practicable, without unreasonable delay, and by day 30 after breach determination or reason to believe it occurred; specified delay/waiver applies (§ 501.171(4)(a)-(c)) |
Department of Legal Affairs at ≥500 Florida individuals, as practicable and by day 30 after determination/reason; written synopsis, count, services, consumer-notice action, and contact (§ 501.171(3)) |
More than 1,000 people notified at one time: also notify all nationwide consumer-reporting agencies of timing, distribution and content, without unreasonable delay (§ 501.171(5)) |
Mail to recorded address or email to recorded address; include breach date/range, affected information, and entity contact route (§ 501.171(4)(d)-(e)) |
Direct notice infeasible because cost >$250,000, affected people >500,000, or no mail/email address; website if maintained plus print and broadcast media in affected urban/rural areas (§ 501.171(4)(f)) |
Written police request sets individual-notice delay; timely written good-cause request may add 15 days for individual notice; qualifying federal-regulator notice route with timely department copy (§ 501.171(3)(a), (4)(b),(g)) |
| Georgia verified 2026-10-14 | Fee-based information broker primarily furnishing personal information to unaffiliated third parties; processor storing its data must notify broker within 24 hours (§§ 10-1-911(3), 10-1-912(a)-(b)) |
Unauthorized acquisition of electronic data; name plus listed IDs/accounts/access codes, or listed data alone if sufficient for identity theft; public records excluded (§ 10-1-911(1), (6)) |
No general harm-likelihood screen in this scheme; good-faith employee/agent use is excluded if no further unauthorized use or disclosure (§§ 10-1-911(1), 10-1-912(a)) |
Georgia residents whose unencrypted personal information was or reasonably is believed acquired without authorization (§ 10-1-912(a)) |
Most expedient time possible without unreasonable delay after discovery or notification; no numbered outside day limit (§ 10-1-912(a)) |
No routine state-regulator notice in the information-broker and data-collector breach-notice section (§ 10-1-912(a)-(d)) |
More than 10,000 Georgia residents notified at once: tell nationwide consumer-reporting agencies timing, distribution, and content without unreasonable delay (§ 10-1-912(d)) |
Written, telephone, or federal e-signature-compliant electronic notice; no universal letter content specified (§ 10-1-911(4)(A)-(C)) |
Cost over $50,000, class over 100,000, or insufficient contacts; email if available, website if maintained, and major statewide media together (§ 10-1-911(4)(D)) |
Law-enforcement determination that notice compromises criminal investigation, until clearance; qualifying own security-policy notice can comply if timing is met (§§ 10-1-911(4)(D), 10-1-912(c)) |
| Hawaii verified 2026-10-14 | Owner/licensee of HI residents' PI, or HI-operating business owning/licensing PI in any form, tells affected person; HI-located/operating nonowner holder of residents' PI tells owner/licensee immediately (§ 487N-2(a)-(b)) |
Unauthorized access AND acquisition of unencrypted/unredacted paper or electronic PI with illegal use or likely use and harm risk; name plus SSN, HI driver/ID, or financial access data; encrypted records plus key also breach (§§ 487N-1, 487N-2(a)) |
Breach definition requires illegal use or likely illegal use creating risk of harm for unencrypted data; encrypted data acquired with key separately counts; good-faith lawful employee acquisition excluded (§ 487N-1) |
Affected person under owner's/licensor's HI-resident or HI-business route; provider gives owner/licensee notice, not substitute direct resident notice (§ 487N-2(a)-(b)) |
Without unreasonable delay after discovery/notification; contact identification, scope investigation, and system restoration allowed; no fixed outside day count (§ 487N-2(a)) |
If business notifies more than 1,000 persons at one time, written Office of Consumer Protection notice without unreasonable delay, stating notice timing, distribution, content; 20-day legislature report is government-only (§§ 487N-2(f), 487N-4) |
Same more-than-1,000-at-one-time business trigger: written notice to all nationwide consumer-reporting agencies without unreasonable delay of notice timing, distribution, and content (§ 487N-2(f)) |
Clear, conspicuous notice by postal writing, consented qualifying email, or direct phone contact; describe incident, exposed PI, protection steps, assistance phone if any, and credit-report vigilance (§ 487N-2(d)-(e)) |
Cost over $100,000, affected class over 200,000, missing contact/consent, or unidentifiable people; all available email, website posting, AND statewide media; missing-contact/unknown routes cover only those persons (§ 487N-2(e)(4)) |
Law-enforcement written or contemporaneously documented delay request for criminal investigation/national security; resume when cleared. Specified federal financial or compliant HIPAA procedures satisfy; statutory waiver void (§ 487N-2(c),(g)-(h)) |
| Idaho verified 2026-10-14 | ID business owning/licensing computerized resident PI; nonowner maintainer tells and cooperates with owner/licensee immediately after discovery if misuse occurred or is likely (§ 28-51-105(1),(2)) |
Illegal acquisition of unencrypted computerized PI materially compromising it; name plus SSN, driver/ID, or financial-account access; public-data and good-faith employee exclusions (§ 28-51-104(2),(5)) |
Prompt good-faith investigation; resident and owner notice if misuse occurred or is reasonably likely (§ 28-51-105(1),(2)) |
Affected Idaho resident after investigation finds actual or reasonably likely misuse (§ 28-51-105(1)) |
As soon as possible, most expedient time possible, without unreasonable delay; no fixed outside day count (§ 28-51-105(1)) |
No general private-entity AG report in §§ 28-51-104 to -106; 24-hour AG rule applies to public agencies only; primary regulators enforce violations (§§ 28-51-105(1), 28-51-104(6)) |
No separate consumer-reporting-agency notice in §§ 28-51-104 to -106 (§§ 28-51-105, 28-51-106) |
Writing to most recent recorded address, telephone, or qualifying electronic notice; no itemized resident-letter contents in §§ 28-51-104 to -106 (§ 28-51-104(4)) |
Cost over $25,000, over 50,000 ID residents, or insufficient contacts: email if available AND website if maintained AND major statewide media (§ 28-51-104(4)(d)) |
Law-enforcement advice that notice impedes criminal investigation permits delay until cleared; timely own-policy or primary-regulator-procedure routes (§§ 28-51-105(3), 28-51-106) |
| Illinois verified 2026-10-14 | Owner/licensee data collector gives resident notice; nonowner custodian tells owner/licensee immediately after discovery and cooperates (§§ 5, 10(a)-(b)) |
Unauthorized acquisition of compromised computerized data; name plus listed identifiers, health or biometric data, or online credentials, including readable key-compromised data (§ 5) |
Good-faith employee/agent acquisition for a legitimate purpose excluded unless misused or further disclosed; § 5 has no separate harm test |
Illinois residents whose covered information was involved in an owner's or licensee's breach; custodian notice goes to owner/licensee (§ 10(a)-(b)) |
After discovery or notification, most expedient time possible and without unreasonable delay; scope and system-restoration measures allowed (§ 10(a)) |
More than 500 Illinois residents owed notice from one breach: Attorney General without unreasonable delay and no later than resident notice; three incident items (§ 10(e)) |
No separate private-collector duty in § 10; § 12(d)'s more-than-1,000-person agency duty applies to State agencies |
Written or qualifying electronic notice; identity-data notice lists credit agencies, FTC, and fraud-alert/freeze information; credential notice may direct account changes (§ 10(a), (c)) |
Cost over $250,000, class over 500,000, or insufficient contacts; available email, website if maintained, and statewide or qualifying local media together (§ 10(c)(3)) |
Written law-enforcement request when notice would interfere with criminal investigation; timely own-policy route; compliant HIPAA route with conditional AG notice (§§ 10(b-5), (d), 50) |
| Indiana verified 2026-10-14 | IN commercial data-base owner: resident and AG notice; nonowner maintainer: owner notice; 45-day discovery ceiling (§§ 24-4.9-2-3 to -4, 24-4.9-3-1 to -3) |
Unauthorized acquisition of computerized data, including transferred paper; unencrypted PI or encrypted PI plus compromised key; SSN alone, name-plus listed IDs/accounts, or adult-site records (§§ 24-4.9-2-2, -10, 24-4.9-3-1) |
Owner knows/should know acquisition caused or could cause identity deception, theft, or fraud; good-faith employee and secure-device exclusions (§§ 24-4.9-2-2, 24-4.9-3-1(a)) |
IN resident by principal mailing address in owner records, whose unencrypted PI or encrypted PI plus key was or may have been acquired (§§ 24-4.9-2-7, 24-4.9-3-1(a)) |
Without unreasonable delay, no more than 45 days after discovery; enumerated restoration, scope, AG/law-enforcement delay and prompt-resumption rules (§ 24-4.9-3-3) |
Attorney General whenever owner makes resident disclosure, no numerical threshold; same without-unreasonable-delay/45-day discovery rule (§§ 24-4.9-3-1(c), -3) |
More than 1,000 consumers disclosed: each consumer reporting agency gets fraud-prevention information, including affected IN residents' PI (§ 24-4.9-3-1(b)) |
Mail, telephone, fax, or email if address held; chapter prescribes no consumer-letter content list (§ 24-4.9-3-4(a)) |
More than 500,000 IN residents OR cost above $250,000; website post if maintained AND major local news media; no missing-contact trigger (§ 24-4.9-3-4(b)) |
System restoration/scope or AG/law-enforcement request for investigation/national security; resume ASAP; at-least-as-stringent own policy and specified federal/financial routes (§ 24-4.9-3-3 to -4) |
| Iowa verified 2026-10-14 | Owner/licensee of computerized PI used in business, vocation, occupation, or volunteer activities notifies residents; nonowner holder tells owner/licensor immediately after discovery (§ 715C.2(1)-(2)) |
Unauthorized acquisition of computerized PI or paper copied from computerized form; name plus ID, financial-access, or biometric data; compromised keys can count (§ 715C.1(1),(11)) |
No notice if proper investigation or law-enforcement consultation finds no reasonable likelihood of financial harm; written determination kept five years (§ 715C.2(6)) |
Iowa residents whose PI was included in breached information (§§ 715C.1(2), 715C.2(1)) |
Most expeditious manner possible without unreasonable delay after discovery or owner notification; scope/contact/system work allowed; no fixed outer day limit (§ 715C.2(1)) |
More than 500 Iowa residents requiring notice; written notice to AG consumer protection division within five business days after first consumer notice (§ 715C.2(8)) |
No separate reporting-agency notice in Chapter 715C; resident letter must include agency contact information (§ 715C.2(5)(d)) |
Written or qualifying electronic notice; letter states breach description/date, data type, reporting-agency contacts, and identity-theft reporting advice (§ 715C.2(4)-(5)) |
Cost over $250,000, affected class over 350,000, or insufficient contacts: email if available AND website post/link if maintained AND statewide media (§ 715C.2(4)(c)) |
Written law-enforcement delay request until written clearance; qualifying federal/state or GLBA/HIPAA-HITECH compliance routes (§ 715C.2(3),(7)) |
| Kansas verified 2026-10-14 | Business owning or licensing computerized resident PI; nonowner holder tells owner/licensee after discovery if unauthorized person accessed and acquired it (§ 50-7a02(a),(b)) |
Unauthorized access AND acquisition of unencrypted or unredacted computerized PI causing or likely to cause identity theft; name plus SSN, ID, or financial-account number; good-faith employee and public-record exclusions (§ 50-7a01(g),(h)) |
Prompt good-faith investigation; resident notice when misuse occurred or is reasonably likely; breach definition also requires actual or reasonably expected identity theft (§§ 50-7a01(h), 50-7a02(a)) |
Affected Kansas resident after the investigation finds misuse occurred or reasonably likely (§ 50-7a02(a)) |
As soon as possible, most expedient time possible, without unreasonable delay; no fixed outer day count (§ 50-7a02(a)) |
No general pre-notice AG or insurance-commissioner filing in §§ 50-7a01 to -02; those officials enforce violations (§ 50-7a02(g),(h)) |
More than 1,000 consumers notified at one time: notify all nationwide consumer-reporting agencies without unreasonable delay of timing, distribution, and content (§ 50-7a02(f)) |
Writing or qualifying electronic notice; no itemized resident-letter contents in §§ 50-7a01 to -02 (§ 50-7a01(c)) |
Direct-notice cost over $100,000, class over 5,000, or insufficient contacts: email if available AND website if maintained AND major statewide media (§ 50-7a01(c),(e)) |
Law-enforcement finding of criminal-investigation impediment permits delay until cleared; consistent-timing own-policy and primary-regulator-procedure routes (§ 50-7a02(c)-(e)) |
| Kentucky verified 2026-10-14 | KY business information holder notifies residents; nonowner data maintainer notifies owner/licensee as soon as reasonably practicable (§ 365.732(1)(b), (2)-(3)) |
Unauthorized acquisition of unencrypted/unredacted computerized PI in multi-person database; name plus SSN, license, or financial access (§ 365.732(1)(a),(c)) |
Breach definition requires actual or reasonably believed identity theft/fraud; good-faith employee acquisition excluded (§ 365.732(1)(a)) |
KY residents whose unencrypted PI was or is reasonably believed acquired without authorization after qualifying breach (§ 365.732(2)) |
Most expedient time possible, without unreasonable delay after discovery/notification; no fixed outer day limit (§ 365.732(2)) |
No general AG report in § 365.732; qualifying insurance licensee reports to insurance commissioner within 3 business days after event determination (§§ 365.732, 304.3-760(1)) |
More than 1,000 persons at one time: all nationwide agencies and credit bureaus without unreasonable delay; timing, distribution, content (§ 365.732(7)) |
Written or qualifying electronic notice; § 365.732 prescribes no itemized resident-letter contents (§ 365.732(2),(5)) |
Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 365.732(5)(c)) |
Police impediment delay until prompt notice after clearance; timing-consistent own policy; federal GLBA/HIPAA entities excluded (§ 365.732(4),(6),(8)) |
| Louisiana verified 2026-10-14 | Owner/licensee of computerized PI notifies residents; nonowner maintainer notifies owner/licensee after discovery (§ 51:3074(C)-(D)) |
Compromised computerized data reasonably likely to cause unauthorized acquisition AND access; name plus SSN, ID, financial access, passport or biometric data (§ 51:3073(2),(4)) |
No notice after reasonable no-likelihood-of-harm finding; written determination/support retained 5 years from discovery and sent to AG on written request (§ 51:3074(I)) |
LA residents whose PI was or is reasonably believed acquired by unauthorized person (§ 51:3074(C)) |
Most expedient time, without unreasonable delay; generally within 60 days from breach discovery, with documented extension route (§ 51:3074(E)) |
When resident notice required: AG Consumer Protection Section written report naming affected LA citizens; receipt within 10 days after resident notices is timely (LAC 16:III § 701(A)-(B)) |
No general nationwide credit-agency report stated in §§ 51:3073–3074 or LAC 16:III § 701; AG report is separate (§ 51:3074; LAC 16:III § 701) |
Written or qualifying electronic notice; § 51:3074 specifies no itemized resident-letter content (§ 51:3074(C),(G)) |
Cost over $100,000, class over 100,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 51:3074(G)(3)) |
Police impediment or incident-scope/system measures may delay; written reasons to AG within 60 days for extension; timing-consistent own policy route (§ 51:3074(E)-(F),(H)) |
| Maine verified 2026-10-14 | Information broker or other person maintaining computerized PI investigates/possibly tells residents; third-party nonowner holder tells the person maintaining PI immediately after discovering unauthorized acquisition (§§ 1347(3), 1348(1)-(2)) |
Unauthorized acquisition, release OR use of computerized PI compromising security/confidentiality/integrity; name plus SSN, state ID, usable financial number or access code; certain standalone elements count (§ 1347(1),(6)-(7)) |
Good-faith prompt misuse investigation; broker tells acquired/reasonably-believed-acquired residents without separate misuse condition; other person tells if misuse occurred or reasonably possible; good-faith employee activity excluded if no further misuse/disclosure (§§ 1347(1), 1348(1)) |
ME resident whose PI unauthorized person acquired or likely acquired (broker); ME resident when misuse occurred or reasonably possible (other holder); nonowner third party tells person maintaining PI (§ 1348(1)-(2)) |
Expeditiously without unreasonable delay; absent law-enforcement delay, no more than 30 days after holder becomes aware of breach AND identifies scope; third party immediately after discovery (§ 1348(1)-(3)) |
Whenever resident notice under § 1348(1) required, tell appropriate Department of Professional and Financial Regulation regulator, or AG if not department-regulated; no separate fixed regulator day count (§ 1348(5)) |
If required to notify >1,000 persons at one time, tell nationwide consumer-reporting agencies without unreasonable delay; include breach date, affected estimate if known, and actual/anticipated individual-notice date (§ 1348(4)) |
Written or qualifying federal E-SIGN electronic notice; eligible substitute route. §§ 1347(4), 1348 state no general list of required incident-letter contents (§§ 1347(4), 1348(1)) |
Cost >$5,000, class >1,000, or insufficient contact information; use available email, publicly accessible website posting if maintained, AND major statewide media (§ 1347(4)(C)) |
Law-enforcement criminal-investigation delay; once agency determines no compromise, notify within 7 business days. Federal/state breach procedure route qualifies if at least as protective as § 1348 (§§ 1348(3), 1349(4)) |
| Maryland verified 2026-10-14 | Owner/licensee notifies residents; nonowner computerized-data holder notifies owner/licensee as soon as practicable, within 10 days (§ 14-3504(b)-(c)) |
Unauthorized acquisition of computerized PI; name plus listed IDs, financial-access, health, insurance, biometric or genetic data, or email credentials (§§ 14-3501(e), 14-3504(a)) |
Prompt good-faith misuse investigation; no resident notice on reasonable no-likelihood finding; retain determination records 3 years (§ 14-3504(b)(1)-(4)) |
MD resident whose PI was involved, unless reasonable investigation finds no likelihood of misuse (§ 14-3504(b)(1)-(2)) |
As soon as reasonably practicable, no later than 45 days after business discovers or is notified of breach, subject to statutory delay (§ 14-3504(b)(3),(d)) |
AG office before resident notice, with MD count, incident account, response steps, form and sample notice; no person threshold (§ 14-3504(h)) |
At 1,000 or more individual notices: notify each nationwide consumer reporting agency without unreasonable delay of timing, distribution and content (§ 14-3506) |
Mail, qualifying email, or telephone; describe acquired data categories and provide business, credit-agency, FTC and AG contacts (§ 14-3504(e),(g)) |
Insufficient direct contact: email if available AND website posting if maintained AND major local print/broadcast media (§ 14-3504(e)(4),(f)) |
Law-enforcement or scope/identity/system-restoration delay; police clearance starts specified 7-day clocks; qualifying regulator, financial or HIPAA compliance routes (§§ 14-3504(d), 14-3507) |
| Massachusetts verified 2026-10-14 | Owner/licensee: resident, AG, consumer-affairs director; nonowner holder: owner notice and cooperation (§ 3(a)-(b)) |
Unauthorized acquisition/use with substantial identity-theft/fraud risk; name plus SSN, ID, or financial-account data; separate known unauthorized acquisition/use trigger (§§ 1, 3) |
Defined breach requires substantial identity-theft/fraud risk; good-faith internal acquisition excluded absent later misuse/disclosure; no general documented harm waiver (§§ 1, 3) |
Owner/licensee notifies affected MA resident; nonowner holder notifies owner/licensee (§ 3(a)-(b)) |
As soon as practicable and without unreasonable delay after knowledge or reason to know; no fixed outer day count; unknown total cannot delay (§ 3(b)) |
AG AND consumer-affairs director for qualifying incident, no numerical threshold; without unreasonable delay; detailed report and sample resident notice (§ 3(b)) |
Director identifies relevant consumer reporting or state agencies; entity then notifies those identified, without unreasonable delay (§ 3(b)) |
Writing or qualifying electronic notice; police-report right, security-freeze instructions/no charge, mitigation services, parent name if applicable; omit breach nature and count (§§ 1, 3) |
Written-notice cost >$250,000, affected class >500,000, or insufficient contact; email if available AND homepage if any AND statewide media (§ 1) |
Law-enforcement delay after written AG notification; resume without unreasonable delay on clearance; SSN exposure brings 18-month monitoring, 42 months for reporting agencies (§§ 3A, 4) |
| Michigan verified 2026-10-14 | Owner/licensee: resident notice; nonowner database maintainer: owner/licensor notice, both subject to risk screen (§ 445.72(1)-(3)) |
Unauthorized access AND acquisition of computerized name plus SSN, state ID, or financial credentials; encrypted data with key also count (§§ 445.63(b), (e), (r), 445.72(1)) |
Ordinarily prudent assessment may find no likely substantial loss/injury or identity theft; narrow good-faith employee exclusion (§§ 445.63(b), 445.72(1)-(3)) |
Michigan residents whose unencrypted/unredacted information was accessed and acquired, or whose encrypted information and key were acquired (§ 445.72(1)) |
Without unreasonable delay after discovery or owner notification; scope/integrity and law-enforcement delays; no numeric outside limit (§ 445.72(1), (4)) |
No routine AG incident filing in current § 445.72; AG may sue for civil fine on knowing failure to notify (§ 445.72(1)-(18)) |
More than 1,000 Michigan residents notified: tell nationwide agencies notice count and timing without unreasonable delay afterward; GLBA exception (§ 445.72(8)) |
Mail; qualifying email; live consented phone or fallback mail/email; clear breach, data type, protective steps, help number, fraud vigilance (§ 445.72(5)-(6)) |
Direct-notice cost over $250,000 or over 500,000 Michigan residents; email if available, website if maintained, and statewide media together (§ 445.72(5)(d)) |
Scope/integrity work or agency-determined investigation/security delay, then prompt notice; qualifying financial or HIPAA compliance may satisfy (§ 445.72(4), (9)-(10)) |
| Minnesota verified 2026-10-14 | MN business owning/licensing PI notifies residents; nonowner maintainer notifies owner/licensee immediately after discovery (§ 325E.61, subd. 1(a)-(b)) |
Unauthorized acquisition of computerized data; name plus SSN, MN ID/license, or financial-account access; key/password acquisition defeats encryption protection (§ 325E.61, subd. 1(d)-(f)) |
No general risk-of-harm waiver; good-faith employee/agent acquisition without further unauthorized use/disclosure is not breach (§ 325E.61, subd. 1(a),(d)) |
MN residents whose unencrypted PI was or is reasonably believed acquired by unauthorized person (§ 325E.61, subd. 1(a)) |
Most expedient time possible, without unreasonable delay after discovery or notification; no fixed outer day count (§ 325E.61, subd. 1(a)) |
No general AG breach-report route in § 325E.61; AG enforces the section (§ 325E.61, subds. 1, 2, 6) |
More than 500 persons at one time: all nationwide agencies within 48 hours of discovering notice-triggering circumstances; timing, distribution, content (§ 325E.61, subd. 2) |
Mail to latest address or qualifying electronic notice; statute requires disclosure of breach, without enumerated letter details (§ 325E.61, subd. 1(a),(g)) |
Cost over $250,000, affected class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 325E.61, subd. 1(g)(3)) |
Police may affirmatively delay notice to a date certain; timing-consistent own policy may satisfy notice; defined federal financial institutions exempt (§ 325E.61, subds. 1(c),(h), 4) |
| Mississippi verified 2026-10-14 | Person doing business in MS that ordinarily owns, licenses, or maintains resident PI; nonowner maintainer tells owner/licensee as soon as practicable after discovery when fraudulent acquisition is involved (§ 75-24-29(1),(4)) |
Unauthorized acquisition of unsecured electronic PI; name plus SSN, driver/state ID, or financial-account access; public information excluded (§ 75-24-29(2)) |
No notice after appropriate investigation reasonably finds breach unlikely to harm affected people (§ 75-24-29(3)) |
MS residents whose PI was or reasonably is believed intentionally acquired without authorization (§ 75-24-29(2),(3)) |
Without unreasonable delay after investigation for scope, affected people, or integrity; no fixed outer day count (§ 75-24-29(3)) |
No general AG filing in § 75-24-29; AG enforces violations, and 2025-2026 proposed reporting bills died (§ 75-24-29(8)) |
No separate nationwide consumer-reporting-agency notice in § 75-24-29 (§ 75-24-29(1)-(8)) |
Writing, telephone, qualifying electronic notice; no itemized resident-letter contents in § 75-24-29 (§ 75-24-29(3),(6)) |
Cost over $5,000, class over 5,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 75-24-29(6)) |
Requested law-enforcement delay for criminal investigation or national security until clearance; timely own-policy or primary-regulator-policy route (§ 75-24-29(5),(7)) |
| Missouri verified 2026-10-14 | MO owner/licensee of resident PI: resident notice; nonowner holder: immediate owner notice (§ 407.1500.2(1)-(2)) |
Unauthorized access AND acquisition of computerized PI; name + SSN, government ID, financial-access data, medical or health-insurance data (§ 407.1500.1(1),(9)) |
After investigation/agency consultation, no notice if identity-theft/fraud risk not reasonably likely; written determination retained 5 years (§ 407.1500.2(5)) |
Affected MO consumer, meaning state resident, after owner discovers or is told of qualifying breach (§ 407.1500.1(2), .2(1)) |
Without unreasonable delay; no fixed outer day limit; investigation and contact/scope/system restoration allowed (§ 407.1500.2(1),(3)) |
More than 1,000 consumers at one time: AG office without unreasonable delay; qualifying insurance licensee also reports to insurance director within 4 business days of determination (§§ 407.1500.2(8), 375.1410.1) |
More than 1,000 consumers at one time: nationwide consumer reporting agencies get timing, distribution, and content without unreasonable delay (§ 407.1500.2(8)) |
Writing, consented qualifying email, or direct phone; general incident, PI type, available help number, CRA contacts, vigilance advice (§ 407.1500.2(4),(6)) |
Cost >$100,000, class >150,000, inadequate contact/consent, or unidentifiable consumers; email if available AND website if any AND statewide media (§ 407.1500.2(6)-(7)) |
Written/documented police request for criminal investigation or national/homeland security; resume without unreasonable delay; policy/regulator/financial compliance routes (§ 407.1500.2(3), .3) |
| Montana verified 2026-10-14 | MT-conducting person/business owning/licensing computerized PI tells residents; nonowner holder tells owner/licensee immediately after qualifying discovery (§ 30-14-1704(1)-(2)) |
Unauthorized acquisition of computerized PI materially compromising security/confidentiality/integrity and causing or likely causing MT resident loss/injury; name plus SSN, state/tribal ID, financial access, medical, tax ID, or IRS identity PIN (§ 30-14-1704(4)) |
Breach definition requires actual/reasonably believed loss or injury; good-faith employee/agent business acquisition excluded absent further use/disclosure (§ 30-14-1704(4)(a)) |
Montana resident whose unencrypted PI was or is reasonably believed acquired by unauthorized person; nonowner holder tells owner/licensee (§ 30-14-1704(1)-(2)) |
Without unreasonable delay after discovery/notification, subject to lawful delay and scope/system-integrity measures; no fixed outside day count (§ 30-14-1704(1),(3)) |
Every required individual notification triggers simultaneous electronic copy plus distribution date/method to AG consumer protection office; omit identities, give MT count if multiple recipients (§ 30-14-1704(8)) |
If business's notice mentions obtaining a consumer-credit file, coordinate its timing, content and distribution with the agency without unreasonable individual delay; no numeric bureau-notice trigger (§ 30-14-1704(7)) |
Written, E-SIGN-consistent electronic, telephone, or eligible substitute; qualifying own information-security-policy notice also allowed; § 30-14-1704 states no general letter-content list (§ 30-14-1704(5)-(6)) |
Cost >$250,000, class >500,000, or insufficient contact; available email AND website posting if maintained, OR applicable local/statewide media (§ 30-14-1704(5)) |
Law-enforcement agency must determine criminal-investigation impediment and request delay; notify after clearance. Own policy route requires no unreasonable delay and notice under policy (§ 30-14-1704(3),(6)) |
| Nebraska verified 2026-10-14 | NE business owning/licensing resident PI; nonowner holder alerts and cooperates with owner/licensee when aware of breach with actual or likely unauthorized use (§ 87-803(1),(3)) |
Unauthorized acquisition of unencrypted computerized PI; compromised key means data not encrypted; name plus SSN, ID, financial access, routing code, or biometrics, or online credentials (§ 87-802(1),(3),(5)) |
Prompt good-faith investigation; resident and owner notice when unauthorized use occurred or is reasonably likely; good-faith employee and court-order acquisitions excluded (§§ 87-803(1),(3), 87-802(1)) |
Affected Nebraska resident after investigation finds actual or reasonably likely unauthorized use (§ 87-803(1)) |
As soon as possible and without unreasonable delay; no fixed outer day limit (§ 87-803(1)) |
Attorney General notice for every breach requiring resident notice, no later than resident notice; no numerical threshold (§ 87-803(2)) |
No separate consumer-reporting-agency notification in §§ 87-802 to -804 (§§ 87-803(1)-(4), 87-804(1),(2)) |
Writing, telephone, or qualifying electronic notice; no itemized resident-letter contents in §§ 87-802 to -804 (§ 87-802(4)) |
Cost over $75,000, over 100,000 residents, or insufficient contacts: email if held AND website if maintained AND statewide media; <=10 employees and cost over $10,000 has additional local-ad route (§ 87-802(4)(d),(e)) |
Law-enforcement finding that notice impedes criminal investigation permits delay until cleared; timely own-policy or primary-regulator procedures must notify residents AND AG (§§ 87-803(4), 87-804(1),(2)) |
| Nevada verified 2026-10-14 | Data collector owning/licensing computerized PI notifies residents; nonowner maintainer notifies owner/licensee immediately on discovery (§§ 603A.030, 603A.220(1)-(2)) |
Unauthorized acquisition materially compromising computerized PI; name plus SSN, ID, financial access, medical/insurance ID, or online credentials; unencrypted data (§§ 603A.020, 603A.040) |
Material compromise is part of breach definition; good-faith employee acquisition excluded absent unrelated use or unauthorized disclosure; no separate harm screen (§§ 603A.020, 603A.220(1)) |
Nevada residents whose unencrypted PI was or reasonably is believed acquired by an unauthorized person (§ 603A.220(1)) |
Most expedient time possible without unreasonable delay after discovery or notification; scope and integrity work allowed; no fixed outer day count (§ 603A.220(1)) |
No general AG report under § 603A.220; subsection (6) instead adds nationwide reporting-agency notice above 1,000 people (§ 603A.220(1)-(7)) |
More than 1,000 people notified at one time; each nationwide agency, without unreasonable delay, with notice distribution time and content (§ 603A.220(6)) |
Writing or qualifying electronic notice; § 603A.220 prescribes no itemized resident-letter content (§ 603A.220(1),(4)) |
Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 603A.220(4)(c)) |
Police investigation delay until clearance; timely own-policy or GLBA-compliant route; chapter-675 licensees excluded (§ 603A.220(3),(5),(7)) |
| New Hampshire verified 2026-10-14 | NH-doing-business owner/licensee of computerized PI assesses and notifies; nonowner holder tells and cooperates with owner/licensee immediately after discovering unauthorized acquisition (§ 359-C:20(I)(a),(c)) |
Unauthorized acquisition of computerized PI compromising security/confidentiality; name plus SSN, government ID, or financial account plus access credential; key acquired with encrypted data defeats encryption (§ 359-C:19) |
Promptly determine misuse likelihood; notify if misuse occurred, is reasonably likely, OR cannot be determined. Good-faith employee/agent business acquisition excluded if not misused/disclosed (§§ 359-C:19(V), 359-C:20(I)(a)) |
Affected individuals when owner's/licensee's misuse test is met; nonowner holder instead gives immediate owner/licensee notice and cooperation (§ 359-C:20(I)(a),(c)) |
After awareness of breach, promptly assess misuse; if notice required, notify as soon/quickly as possible after determination; no fixed outside day limit (§ 359-C:20(I)(a)-(b)) |
No numeric threshold stated: RSA 358-A:3(I) regulated trade/commerce entity notifies its primary regulator; all others notify NH AG. Include anticipated individual-notice date and approximate NH count; no separate fixed day limit (§ 359-C:20(I)(b)) |
If required to notify >1,000 consumers, tell all nationwide consumer-reporting agencies without unreasonable delay the anticipated notice date, approximate count, and content; Title V Gramm-Leach-Bliley entities exempt (§ 359-C:20(VI)) |
Written; electronic only if primary communication is electronic; telephone with notification log; or eligible substitute/internal-policy route. Include incident, approximate breach date, PI type obtained, and entity telephone contact (§ 359-C:20(III)-(IV)) |
Cost >$5,000, class >1,000, or insufficient contact information/consent; combine available email, website posting if maintained, AND major statewide media (§ 359-C:20(III)(d)) |
Law-enforcement/national/homeland-security agency determination allows delay; qualifying regulator-governed trade/commerce entity complying with regulator breach procedures deemed compliant; internal-policy notice method also listed (§ 359-C:20(II),(III)(e),(V)) |
| New Jersey verified 2026-10-14 | Business conducting business in NJ: customer notice; nonowner record maintainer: immediate notice to data holder (§ 56:8-163(a)-(b)) |
Unauthorized access to unsecured electronic data; name plus SSN, ID, financial credentials, or account credentials; linked dissociated data count (§ 56:8-161) |
No customer disclosure if misuse is not reasonably possible; written determination kept five years; good-faith employee exclusion (§§ 56:8-161, 56:8-163(a)) |
NJ resident customers whose personal information was or is reasonably believed accessed without authorization (§ 56:8-163(a)) |
Most expedient time possible, without unreasonable delay after discovery or notification; no numbered outside limit (§ 56:8-163(a)) |
Division of State Police report before customer disclosure; no affected-person threshold or numbered clock (§ 56:8-163(c)(1)) |
More than 1,000 persons requiring notice at one time: nationwide agencies get timing, distribution and content without unreasonable delay (§ 56:8-163(f)) |
Written or E-SIGN-consistent electronic notice; credential-only notice may direct account-protection steps; no general letter-content list (§ 56:8-163(d), (g)) |
Cost over $250,000, over 500,000 recipients, or insufficient contact data: available email, website if maintained, AND statewide media (§ 56:8-163(d)(3)) |
Scope/system-restoration measures; requested law-enforcement investigation delay until cleared; consistent own-policy notice route (§ 56:8-163(a), (c)(2), (e)) |
| New Mexico verified 2026-10-14 | Owner/licensee of NM resident PI; nonowner licensed holder tells owner/licensee as expediently as possible, within 45 calendar days of discovery, subject to risk screen (§ 57-12C-6(A),(C)) |
Unauthorized acquisition of unencrypted computerized PI, or encrypted data plus decryption key; name plus SSN, ID, financial-account access, or biometrics; public-data and good-faith employee exclusions (§ 57-12C-2(C),(D)) |
Appropriate investigation may find no significant risk of identity theft or fraud, removing resident or owner notice; GLBA/HIPAA-covered persons exempt from Act (§§ 57-12C-6(B),(C), 57-12C-8) |
Each NM resident whose PI is reasonably believed subject to a security breach (§ 57-12C-6(A)) |
Most expedient time possible, at most 45 calendar days after discovery; statutory investigation or police delay may apply (§§ 57-12C-6(A), 57-12C-9) |
More than 1,000 NM residents notified for one breach: AG notice as expediently as possible, within 45 calendar days; send resident count and notice copy within 45 days after discovery; substitute notice also includes written AG notice (§§ 57-12C-10, 57-12C-6(E)) |
More than 1,000 NM residents notified for one breach: notify major nationwide consumer-reporting agencies as expediently as possible, within 45 calendar days, subject to delay (§ 57-12C-10) |
US mail or qualifying electronic notice; identify notifier, data types and breach dates if known, incident, major agencies, and account/credit-report and federal-rights advice (§§ 57-12C-6(D), 57-12C-7) |
Cost over $100,000, over 50,000 residents, or no physical address/sufficient contacts: email valid addresses AND website if maintained AND written AG plus major NM media (§ 57-12C-6(D),(E)) |
Delay if police determine notice impedes criminal investigation, or as necessary to assess scope and restore system; timely own-policy route; GLBA/HIPAA exemption (§§ 57-12C-9, 57-12C-6(F), 57-12C-8) |
| New York verified 2026-10-14 | Person or business owning/licensing computerized private information: resident notice; nonowner custodian: owner/licensee notice immediately and within 30 days (§ 899-aa(2)-(3)) |
Unauthorized access or acquisition of computerized private information; listed identifiers, medical/insurance/biometric data, or online credentials; encryption key compromise counts (§ 899-aa(1)) |
Narrow inadvertent authorized-person disclosure with no likely misuse or specified harm; written decision kept five years, AG copy within ten days if over 500 residents (§ 899-aa(2)(a)) |
New York residents whose private information was or is reasonably believed accessed or acquired without valid authorization (§ 899-aa(2)) |
Most expedient time possible, without unreasonable delay, within 30 days after discovery; law-enforcement exception (§ 899-aa(2), (4)) |
Any New York resident notice: AG, Department of State, State Police, and DFS only for a 23 NYCRR 500.1 covered entity; send timing/content/distribution, count, and notice template without delaying residents (§ 899-aa(8)(a)) |
More than 5,000 New York residents notified at once: tell consumer-reporting agencies timing, content, distribution, and approximate count without delaying residents (§ 899-aa(8)(b)) |
Writing; express-consent electronic notice with log; logged phone notice; contact and agency resources plus affected-data categories; qualifying substitute route (§ 899-aa(5), (7)) |
Cost over $250,000, class over 500,000, or insufficient contacts, shown to AG; available email or special credential-account notice, website if maintained, and statewide media together (§ 899-aa(5)(d)) |
Law-enforcement determination that notice impedes criminal investigation; notice after clearance; qualifying federal/state breach notice can replace repeat resident notice while state and agency duties remain (§ 899-aa(2)(b), (4)) |
| North Carolina verified 2026-10-14 | Business owning/licensing personal information: affected-person notice; nonowner holder: immediate owner/licensee notice after discovery (§§ 75-61(1), 75-65(a)-(b)) |
Unauthorized access AND acquisition of unencrypted/unredacted data with illegal use, likely use, or material harm risk; encrypted data with key also count; paper included (§§ 75-61(10), (14), 75-65(a)) |
Illegal-use or material-harm test in breach definition; good-faith employee acquisition for lawful business use excluded if no further unauthorized disclosure (§ 75-61(14)) |
Affected persons whose personal information was subject to a defined security breach; business may hold paper or electronic records (§§ 75-61(10), (14), 75-65(a)) |
Without unreasonable delay after discovery or notification; no numeric outside limit, with scope/contact/system-integrity work and law-enforcement delay (§ 75-65(a), (c)) |
Any affected-person notice: notify AG Consumer Protection Division without unreasonable delay of nature, count, investigation/prevention steps, and notice timing/distribution/content (§ 75-65(e1)) |
More than 1,000 people notified at one time: tell all nationwide consumer-reporting agencies timing, distribution, and content without unreasonable delay (§ 75-65(f)) |
Clear, conspicuous notice with seven statutory content items; writing, consent-based compliant email, or direct telephone contact (§ 75-65(d)-(e)(3)) |
Cost over $250,000, class over 500,000, insufficient contact/consent, or unidentifiable persons; email if available, website if maintained, and statewide media together (§ 75-65(e)(4)) |
Documented written law-enforcement request for investigation/national-security delay until clearance; qualifying federal financial-institution guidance compliance counts (§ 75-65(c), (h)) |
| North Dakota verified 2026-10-14 | Owner/licensee of computerized PI tells affected ND residents; nonowner holder tells owner/licensee immediately after discovering actual/likely unauthorized acquisition (§§ 51-30-02–03) |
Unauthorized acquisition of computerized data with PI not secured by encryption or unreadability method; name plus SSN, ND license/ID, financial access, birth date, mother's maiden name, medical/insurance, employer ID plus code, or e-signature (§ 51-30-01(1),(4)) |
Statute triggers notice from unencrypted acquisition/reasonable belief; good-faith employee/agent acquisition excluded if no further use/disclosure; no separate harm screen in § 51-30-02 (§§ 51-30-01(1), 51-30-02) |
ND resident whose unencrypted PI was or reasonably believed acquired by unauthorized person; nonowner holder tells owner/licensee (§§ 51-30-02–03) |
Most expedient time possible without unreasonable delay after discovery/notification, consistent with scope/system-restoration work and law enforcement; no fixed outer day count (§§ 51-30-02, 51-30-04) |
Breach exceeding 250 individuals triggers AG notice by mail/email; § 51-30-02 does not limit the count to ND residents or state a separate AG day count (§ 51-30-02) |
Chapter 51-30 names the AG as an added notice recipient above 250 individuals; it states no separate nationwide consumer-reporting-agency notification (§§ 51-30-02–06) |
Written or E-SIGN-consistent electronic notice, or eligible substitute; Chapter 51-30 gives no separate resident-letter content checklist (§§ 51-30-02, 51-30-05) |
Cost >$250,000, affected class >500,000, or insufficient contact; combine available email, website posting if maintained, AND major statewide media (§ 51-30-05(3)) |
Law-enforcement criminal-investigation determination delays until clearance; compliant own-policy notice route, federal financial-guidance route, or qualifying HIPAA breach-notification route (§§ 51-30-04, 51-30-06) |
| Ohio verified 2026-10-14 | Owner/licensee of computerized personal information: resident notice; custodian storing data for another person or government: expeditious owner notice (§ 1349.19(B)-(C)) |
Unauthorized access AND acquisition of readable name plus SSN, ID number, or financial-account credentials, with material fraud risk; public information excluded (§ 1349.19(A)(1), (7), (B)) |
Material identity-theft/other-fraud risk is part of the breach and resident-notice tests; good-faith employee and compelled-access exclusions (§ 1349.19(A)(1), (B)) |
Ohio residents, defined by principal mailing address in the holder's records, whose information was or reasonably is believed accessed and acquired (§ 1349.19(B)(1)) |
Most expedient time possible; no later than 45 days after discovery or notification, subject to statutory investigation measures and law-enforcement delay (§ 1349.19(B)(2), (D)) |
No routine AG breach filing in this private-entity notice section; AG may investigate alleged noncompliance (§ 1349.19(B)-(I)) |
More than 1,000 Ohio residents in one breach: notify all nationwide consumer-reporting agencies of resident-notice timing, distribution, and content without unreasonable delay (§ 1349.19(G)) |
Writing, electronic notice if primary resident contact is electronic, or telephone; statute prescribes methods but no universal letter text (§ 1349.19(E)(1)-(3)) |
General: insufficient contacts, cost over $250,000, or class over 500,000, with email, site if maintained, and media reaching 75% of Ohio; separate ≤10-employee/$10,000 route (§ 1349.19(E)(4)-(5)) |
Law-enforcement finding that notice impedes an investigation or jeopardizes homeland/national security, until agency clearance; limited financial-institution and HIPAA-covered-entity exclusions (§ 1349.19(D), (F)) |
| Oklahoma verified 2026-10-14 | Owner or licensee of computerized PI notifies residents; nonowner maintainer tells owner/licensee as soon as practicable after determination (§ 163(A),(C)) |
Unauthorized access AND acquisition of unencrypted/unredacted computerized PI; name plus ID, financial-access, or biometric data; compromised keys can count (§§ 162(1),(6), 163(A)-(B)) |
Breach requires actual or reasonably believed identity theft or other fraud; good-faith employee acquisition excluded if no improper use/disclosure (§ 162(1)) |
Oklahoma residents whose PI was or reasonably is believed accessed and acquired by an unauthorized person after a qualifying breach (§ 163(A)-(B)) |
Without unreasonable delay after determination or notification; scope and system-restoration work may precede notice; no fixed outer day count (§ 163(A)) |
AG at 500 affected Oklahoma residents (1,000 for credit bureaus); without unreasonable delay, no later than 60 days after resident notice; specified incident report (§ 163(E)) |
No separate nationwide consumer-reporting-agency notice in this Act; a credit bureau instead has a 1,000-resident AG-report threshold (§§ 162-166, 163(E)(3)) |
Postal writing, telephone, or electronic notice; Act specifies AG report fields but no itemized resident-letter fields (§§ 162(7), 163(A),(E)) |
Cost over $50,000, affected class over 100,000, or insufficient contacts/consent: any TWO of email if available, website if maintained, statewide media (§ 162(7)(d)) |
Law-enforcement impediment or security delay; timely own-policy route or qualifying regulated-entity route, with applicable AG report retained (§§ 163(A),(D), 164) |
| Oregon verified 2026-10-27 | A covered entity owns, licenses or otherwise possesses personal information in business, occupational or volunteer activity; a sole vendor is separately defined. A vendor must tell its contracting covered entity, or upstream vendor, as soon as practicable and within 10 days after discovery or reason to believe a breach occurred (§§ 646A.602(5), (19), .604(2)(a)-(b)). |
Unauthorized acquisition of computerized data materially compromising personal information; inadvertent harmless acquisition by the person or its employee or agent is excluded. Covered data include identity-plus-identifier, financial-access, biometric, health and account-credential combinations, with encryption-key and public-record qualifications (§ 646A.602(1), (12)). |
After appropriate investigation or law-enforcement consultation, a covered entity may omit consumer notice if it reasonably determines harm is unlikely, documents that decision in writing and keeps it at least five years (§ 646A.604(8)). |
The covered entity notifies the Oregon resident whose personal information is involved; the statutory consumer definition is an individual resident of Oregon (§§ 646A.602(2), .604(1)(a)). |
Most expeditious manner possible, without unreasonable delay, and no later than 45 days after the covered entity discovers or receives notification of the breach; only the written law-enforcement request in § 646A.604(3)(c) authorizes the listed delay. |
The covered entity gives written or electronic Attorney General notice when it must notify more than 250 consumers; its § 646A.604(3)(a) breach-notice clock is 45 days after discovery or receipt. A vendor must notify the Attorney General if its breach involves more than 250 consumers or an indeterminate count, unless the covered entity has done so (§ 646A.604(1)(b), (2)(c), (3)). |
For a breach affecting more than 1,000 consumers, the covered entity notifies all nationwide consumer-reporting agencies without unreasonable delay of the consumer notice’s timing, distribution and content and any assigned police-report number; this cannot delay consumer notice (§ 646A.604(6)). |
Written, qualifying electronic, direct telephone, or permitted substitute notice. Notice must describe the breach generally, approximate date, data type, covered-entity contact, national reporting-agency contact, and advice to report suspected identity theft to law enforcement and named agencies (§ 646A.604(4)-(5)). |
Substitute notice is allowed if ordinary notice would cost over $250,000, more than 350,000 consumers are affected, or contact information is insufficient. It requires conspicuous website posting or a link if the entity has a site, and notice to major statewide television and newspaper media (§ 646A.604(4)(d)). |
A law-enforcement agency must find notice would impede a criminal investigation and request delay in writing. Specified federal-regulator, stronger-law, GLBA and HIPAA/HITECH routes may substitute; even with those exemptions, more than 250 affected consumers requires an Attorney General copy of a notice sent to consumers or the primary regulator within a reasonable time (§ 646A.604(3)(c), (9)-(10)). |
| Pennsylvania verified 2026-10-14 | Entity maintaining, storing, or managing computerized personal information; vendor holding it for another entity tells that entity after discovery (§ 3(a), (c)) |
Unauthorized access and acquisition materially compromising covered computerized data and causing or likely to cause loss or injury; listed name-plus-data combinations (§ 2) |
Loss or injury is part of the breach definition; good-faith employee acquisition without misuse or further disclosure is excluded (§ 2) |
Pennsylvania residents whose unencrypted, unredacted personal information was or is reasonably believed accessed and acquired; mailing address may establish residency (§ 3(a), (b)) |
Without unreasonable delay after breach determination; scope and system-restoration work or qualifying law-enforcement delay may defer notice (§§ 2, 3(a), 4) |
More than 500 Pennsylvania individuals owed notice: notify Attorney General concurrently, with five specified incident details; insurance-data-security entities exempt (§ 3(c.1)-(c.2)) |
More than 500 persons notified at one time: tell all nationwide consumer-reporting agencies timing, distribution, and number without unreasonable delay (§ 5) |
Mail; qualified phone or prior-relationship email; account-credential electronic direction; conditional no-cost credit report and 12-month monitoring (§§ 2, 3(a.3), 5.4) |
Cost over $100,000, class over 175,000, or insufficient contacts; use available email, website posting if site exists, and statewide media (§ 2) |
Written agency determination that notice impedes a criminal or civil investigation; compliant own-policy or specified regulator/HIPAA routes (§§ 4, 5.3, 7) |
| Rhode Island verified 2026-10-14 | Any private person that stores, owns, collects, processes, maintains, acquires, uses, or licenses covered data may owe direct resident notice; statute does not create a separate processor-to-owner notice route (§§ 11-49.3-3(a)(9), 11-49.3-4(a)(1)) |
Unauthorized access OR acquisition of unencrypted computerized data compromising PI, or disclosure; resident PI acquired/likely acquired with significant identity-theft risk; name plus SSN, state/tribal ID, financial access, medical/insurance, or credentialed email (§§ 11-49.3-3(a)(1),(10), 11-49.3-4(a)(1)) |
Individual notice requires significant risk of identity theft; good-faith employee/agent acquisition excluded when no further misuse/disclosure; encrypted data with access key not treated as encrypted (§§ 11-49.3-3(a)(1),(4), 11-49.3-4(a)(1)) |
RI resident whose PI was or reasonably believed acquired by unauthorized person/entity and whose incident poses significant identity-theft risk (§ 11-49.3-4(a)(1)) |
Most expedient time possible; private person no later than 45 calendar days after breach confirmation AND ability to ascertain subsection (d) contents, subject to law-enforcement delay (§ 11-49.3-4(a)(2)(ii),(b)) |
If >500 RI residents to be notified, tell AG notice timing, content, distribution and approximate affected count; do not delay resident notice; no separate fixed AG day count (§ 11-49.3-4(a)(2)(ii)) |
Same >500 RI-resident trigger: notify major credit-reporting agencies of timing, content, distribution and approximate affected count without delaying resident notice (§ 11-49.3-4(a)(2)(ii)) |
Written or E-SIGN-consistent electronic notice, or eligible substitute; to extent known include incident/how/count, data type, breach/discovery dates, remediation contact, police-report and freeze guidance (§§ 11-49.3-3(c), 11-49.3-4(d)) |
Cost >$25,000, class >50,000, or insufficient contact; all available email, website posting if maintained, AND major statewide media (§ 11-49.3-3(c)(3)) |
Federal/state/local law-enforcement criminal-investigation determination delays; send as soon as practicable after cleared. Qualifying own-policy, functional-regulator, financial or HIPAA compliance routes (§§ 11-49.3-4(b), 11-49.3-6) |
| South Carolina verified 2026-10-14 | SC business owner/licensee notifies residents; nonowner maintainer notifies owner/licensee immediately after discovery (§ 39-1-90(A)-(B)) |
Unauthorized access AND acquisition of unprotected computerized data; name plus SSN, ID, financial access, or other unique government/financial identifiers (§ 39-1-90(A),(D)(1),(3)) |
Illegal use occurred or reasonably likely, OR use creates material resident harm risk; good-faith employee acquisition excluded (§ 39-1-90(A),(D)(1)) |
SC residents whose unprotected PII was or is reasonably believed acquired without authorization when statutory misuse/harm test is met (§ 39-1-90(A)) |
Most expedient time possible, without unreasonable delay after discovery/notification; no fixed outer day limit (§ 39-1-90(A)) |
More than 1,000 persons notified at one time: SC Department of Consumer Affairs Consumer Protection Division, without unreasonable delay (§ 39-1-90(K)) |
Same more-than-1,000-person trigger: all nationwide agencies without unreasonable delay; timing, distribution, content of notice (§ 39-1-90(K)) |
Written, qualifying electronic, or telephone notice; section does not prescribe an itemized resident letter (§ 39-1-90(A),(E)) |
Cost exceeds $250,000, class exceeds 500,000, or insufficient contacts: email if available OR website if maintained OR statewide media (§ 39-1-90(E)(4)) |
Police impediment delay until clearance; timing-consistent own-policy route; qualifying financial-institution exclusions (§ 39-1-90(C),(F),(I)-(J)) |
| South Dakota verified 2026-10-14 | SD-doing-business owner/licensee of computerized resident PI or protected information is the information holder that gives resident notice (§§ 22-40-19(3), 22-40-20) |
Unauthorized acquisition of unencrypted computerized PI/protected information, OR encrypted data with key, materially compromising it; named identifiers include health and employer ID plus credential, while protected account credentials may stand alone (§ 22-40-19(1),(4)-(5)) |
After appropriate investigation and AG notice, reasonable no-likely-harm finding avoids resident notice; document decision in writing and retain ≥3 years; good-faith employee/agent acquisition excluded if no misuse/disclosure (§§ 22-40-19(1), 22-40-20) |
SD resident whose personal OR protected information was/likely was acquired by unauthorized person (§ 22-40-20) |
Within 60 days from discovery or notification of breach; law-enforcement criminal-investigation delay ends ≤30 days after clearance (§§ 22-40-20–21) |
AG notice by mail/email for breach exceeding 250 SD residents; AG notice also prerequisite to no-harm exception; § 22-40-20 states no distinct fixed AG day count (§ 22-40-20) |
Whenever circumstances require resident notice, notify all nationwide consumer-reporting agencies and other nationwide credit bureaus without unreasonable delay of timing, distribution, content; no numeric threshold (§ 22-40-24) |
Writing or qualifying federal E-SIGN/primary-channel electronic notice, or eligible substitute; no separate list of resident-letter contents in notice sections (§§ 22-40-20, 22-40-22) |
Cost >$250,000, class >500,000, or insufficient contact; use available email, website posting if maintained, AND statewide media (§ 22-40-22(3)) |
Law-enforcement impediment determination permits delay, but notice ≤30 days after clearance; own-policy notice must keep timing; compliant federal-regulator procedure route (§§ 22-40-21, 22-40-23, 22-40-26) |
| Tennessee verified 2026-10-14 | TN business/person owning or licensing resident computerized PI: resident notice; nonowner holder: owner/licensee notice, each within 45 days (§ 47-18-2107(a)(3), (b)-(c)) |
Unauthorized acquisition materially compromises unencrypted computerized PI or encrypted data plus key; name + SSN, driver license, or account/payment-card number with access credential (§ 47-18-2107(a)(1),(4)) |
No general post-breach harm waiver; good-faith employee acquisition excluded absent use/further disclosure; public/redacted/unusable information excluded (§ 47-18-2107(a)(1),(4)) |
TN resident whose PI was or reasonably may have been acquired by unauthorized person; nonowner holder instead tells owner/licensee (§ 47-18-2107(b)-(c)) |
No later than 45 days after discovery or notification of breach, subject to law-enforcement delay (§ 47-18-2107(b),(d)) |
No AG or other state-regulator notice route in this general breach-notice section (§ 47-18-2107(b)-(g)) |
More than 1,000 persons at one time: all nationwide consumer reporting agencies and credit bureaus, timing/distribution/content, without unreasonable delay (§ 47-18-2107(g)) |
Writing or qualifying electronic notice, including primary-electronic-communication route; § 47-18-2107(e) prescribes no consumer-letter content list |
Cost >$250,000, class >500,000, or insufficient contacts; email where available AND website if maintained AND major statewide media (§ 47-18-2107(e)(3)) |
Law-enforcement finding that notice impedes investigation; notice within 45 days after clearance. Timely consistent own-policy notice qualifies; GLBA/HIPAA-regulated holders excluded (§ 47-18-2107(d),(f),(i)) |
| Texas verified 2026-10-14 | Business operating in Texas with owned/licensed computerized data: notice to affected people; nonowner custodian: immediate notice to data owner/licensee (§ 521.053(b)-(c)) |
Unauthorized acquisition compromising sensitive personal information; name plus listed unencrypted identifiers, or identifying health information; encrypted data counts if key obtained (§§ 521.002(2), 521.053(a)) |
Actual or reasonably believed unauthorized acquisition triggers notice; § 521.053(a)-(b) states no separate risk-of-harm waiver |
Each individual whose sensitive information was or is reasonably believed acquired; another state's resident may receive notice under that state's law or Texas's (§ 521.053(b), (b-1)) |
Without unreasonable delay; no later than day 60 after breach determination, subject to specified investigation, restoration, or law-enforcement delay (§ 521.053(b), (d)) |
Attorney general: at least 250 Texas residents; electronic website form as soon as practicable and by day 30 after breach determination, with six listed report items (§ 521.053(i)) |
If more than 10,000 persons are notified at one time, also tell each nationwide consumer-reporting agency the timing, distribution, and content, without unreasonable delay (§ 521.053(h)) |
Written notice to last known address, E-SIGN-compliant electronic notice, or qualifying substitute notice; § 521.053(e)-(i) itemizes AG-report content, not consumer-letter content |
Cost over $250,000, more than 500,000 affected persons, or insufficient contact data; then email, conspicuous website posting, or major statewide media (§ 521.053(f)) |
Law-enforcement-requested delay until notice no longer compromises investigation; compliant own-policy notice procedure can satisfy statute (§ 521.053(d), (g)) |
| Utah verified 2026-10-14 | Owner/licensee of computerized PI investigates and notifies; nonowner maintainer notifies and cooperates with owner/licensee immediately after discovery if misuse occurs or is likely; financial institutions excluded (§§ 13-44-102, -103, -202(1),(3)) |
Unauthorized acquisition of computerized PI; name plus SSN, financial-account access, or license/state ID; protected or public data excluded (§ 13-44-102(1),(4)) |
Prompt good-faith investigation; resident notice only if identity-theft/fraud misuse occurred or is reasonably likely; good-faith employee acquisition excluded absent unlawful use/disclosure (§§ 13-44-102(1), -202(1)(a)-(b)) |
Each affected Utah resident when investigation finds identity-theft/fraud misuse occurred or is reasonably likely (§ 13-44-202(1)(b)) |
Most expedient time possible without unreasonable delay after breach scope and reasonable system integrity restored; no fixed outer day limit (§ 13-44-202(2)) |
At 500 affected Utah residents, AG AND Utah Cyber Center; same most-expedient/without-unreasonable-delay timing; specified incident details (§ 13-44-202(1)(c),(2),(6)(b)) |
At 1,000 affected Utah residents, each nationwide consumer reporting agency; same timing rule (§ 13-44-202(1)(d),(2)) |
First-class mail, qualifying electronic notice, or telephone; statute has no itemized resident-letter content, but specifies regulator-report fields (§ 13-44-202(5)(a),(6)(b)) |
If direct methods infeasible for a resident, newspaper of general circulation AND publication under § 45-1-101; no numeric cost/population shortcut (§ 13-44-202(5)(a)(iv)) |
Requested police delay until clearance; timely own-policy or regulated-entity resident-notice route; § 13-44-202 waiver void (§ 13-44-202(4)-(5),(7)) |
| Vermont verified 2026-10-14 | Data collector owning/licensing computerized PI or login credentials tells consumers; nonowner holder immediately tells owner/licensee after discovery (§§ 2430(6), 2435(b)(1)–(2)) |
Actual/reasonably believed unauthorized electronic acquisition compromising PI or login credentials; PI includes name plus ID, financial, biometric, genetic or health data (§ 2430(9)–(10),(13)) |
No consumer notice if misuse not reasonably possible, with detailed regulator explanation; good-faith employee acquisition excluded (§§ 2430(13)(B), 2435(d)(1)–(2)) |
Vermont consumers whose covered information or credentials were breached; nonowner holder alerts owner/licensee (§§ 2430(3), 2435(b)(1)–(2)) |
Most expedient time without unreasonable delay, no later than 45 days after discovery/notification; law-enforcement delay and necessary scope/restoration work (§ 2435(b)(1),(4)) |
AG or Department of Financial Regulation, no person-count threshold; preliminary breach/date report within 14 business days after discovery or by consumer notice, whichever sooner; later count/copy (§ 2435(b)(3)) |
More than 1,000 consumers noticed at once: nationwide agencies receive timing, distribution and content without unreasonable delay; Title 8 licensees/registrants excluded (§ 2435(c)) |
Mail, qualifying email or direct live phone; clear notice with incident/data type, protections, contact, vigilance advice and approximate breach date if known; credentials-only routes (§ 2435(b)(5)–(6),(d)(3)–(4)) |
Lowest direct-method cost >$10,000 or insufficient contact; website if maintained AND major statewide and regional media (§ 2435(b)(6)(B)) |
Law-enforcement request delays until written withdrawal; limited HIPAA substitute and federal-guidance financial institution routes; no waiver (§ 2435(b)(4),(e)–(g)) |
| Virginia verified 2026-10-14 | Owner/licensee: resident and AG notice; nonowner maintainer: owner/licensee notice without unreasonable delay (§ 18.2-186.6(B), (D)) |
Access AND acquisition of computerized name plus SSN, ID, financial credentials, passport, or military ID; encrypted data with key can count (§ 18.2-186.6(A)-(C)) |
Identity theft/other fraud caused or reasonably believed likely; employee good-faith, no-misuse exclusion; encryption/redaction limits (§ 18.2-186.6(A)-(C)) |
Affected Virginia residents whose unencrypted/unredacted information was or is reasonably believed accessed and acquired (§ 18.2-186.6(B)-(C)) |
Without unreasonable delay after discovery or notification; reasonable scope/restoration delay; no numbered outside limit (§ 18.2-186.6(B)) |
AG notice with each qualifying resident breach, without unreasonable delay; over 1,000 notices also report timing, distribution and content (§ 18.2-186.6(B), (E)) |
More than 1,000 people notified at once: all nationwide agencies, without unreasonable delay, with timing, distribution and content (§ 18.2-186.6(E)) |
Mail, phone or electronic; incident, data type, protective acts, help number if any, and vigilance/credit-report advice (§ 18.2-186.6(A)) |
Direct cost over $50,000, over 100,000 VA residents, or insufficient contact/consent: available email, website if maintained, AND statewide media (§ 18.2-186.6(A)) |
Scope/restoration or agency-advised investigation/security delay; consistent own-policy, GLBA, or primary-regulator procedures may satisfy (§ 18.2-186.6(B), (F)-(H)) |
| Washington verified 2026-10-14 | WA business owner/licensee: resident notice; nonowner possessor/maintainer: immediate owner/licensee notice (§ 19.255.010(1)-(2)) |
Unauthorized acquisition of unsecured personal information; broad name/data, login, and qualifying no-name elements; key compromise can count (§§ 19.255.005, 19.255.010(1)) |
No resident notice if breach not reasonably likely to subject consumers to harm; employee good-faith acquisition exclusion (§§ 19.255.005(1), 19.255.010(1)) |
WA residents whose unsecured personal information was or is reasonably believed acquired without authorization (§ 19.255.010(1)) |
Most expedient time, without unreasonable delay, no more than 30 calendar days after discovery, subject to stated delays (§ 19.255.010(8)) |
More than 500 WA residents notified in one breach: AG within 30 days after discovery; affected count, data, exposure, containment and redacted sample (§ 19.255.010(7)) |
No separate agency-recipient report in the general notice duties; resident letter gives nationwide agencies' toll-free numbers and addresses (§ 19.255.010(1)-(8)) |
Writing, E-SIGN-consistent electronic, or credential-specific electronic; plain language, entity contact, data types, exposure dates if known, credit-agency contacts (§ 19.255.010(4), (6)) |
Cost over $250,000, over 500,000 recipients, or inadequate contact: available email, website if maintained, AND statewide media (§ 19.255.010(4)(c)) |
Law-enforcement criminal-investigation determination or scope/system restoration; consistent own-policy route; specified HIPAA and financial routes (§§ 19.255.010(3), (5), (8), 19.255.030) |
| West Virginia verified 2026-10-14 | Individual or entity owning/licensing computerized PI notifies residents; nonowner maintainer tells owner/licensee as soon as practicable after discovering qualifying access and acquisition (§ 46A-2A-102(a),(c)) |
Unauthorized access AND acquisition of unencrypted, unredacted computerized PI, with actual or reasonably expected identity theft/fraud; name plus SSN, driver/state ID, or financial account with access code; public-data and good-faith employee exclusions (§ 46A-2A-101(1),(6)) |
Fraud-risk element is part of breach definition and resident notice test; encrypted data triggers notice if obtained unencrypted or key holder involved and fraud is reasonably expected (§§ 46A-2A-101(1), 46A-2A-102(a)-(b)) |
WV residents whose unencrypted, unredacted PI was or is reasonably believed to have been accessed AND acquired by an unauthorized person, with actual or reasonably expected fraud (§ 46A-2A-102(a)) |
Without unreasonable delay after discovery or notification; scope determination and integrity restoration may precede notice; no fixed outer day count (§ 46A-2A-102(a)) |
No separate AG breach report in general §§ 46A-2A-101 to -104; AG enforces violations, while a licensed financial institution's primary regulator enforces its violations (§§ 46A-2A-102, 46A-2A-104) |
If entity must notify more than 1,000 people, tell all nationwide consumer-reporting agencies without unreasonable delay of timing, distribution, and content, without names; GLBA Title V entities excepted (§ 46A-2A-102(f)) |
Postal writing, telephone, or qualifying electronic notice; include data categories if possible, entity contact for held-data inquiry, major credit-bureau contacts, and fraud-alert/freeze information (§§ 46A-2A-101(7)(A)-(C), 46A-2A-102(d)) |
Cost over $50,000, affected WV class over 100,000, or insufficient contacts; choose any TWO of available email, conspicuous website posting, and major statewide media (§ 46A-2A-101(7)(D)) |
Law-enforcement advice that notice impedes criminal/civil investigation or jeopardizes homeland/national security permits delay until cleared; timely own-policy, federal financial-guidance, or primary-regulator procedure can satisfy article (§§ 46A-2A-102(e), 46A-2A-103) |
| Wisconsin verified 2026-10-14 | In-state business, licensee, resident account holder or lender; nonowner storer without owner contract notifies owner as soon as practicable (§ 134.98(1)(a), (2)(bm)) |
Known unauthorized acquisition of name plus unprotected SSN, ID, financial-account/access, DNA profile or biometric data; no computerized-data limit stated (§ 134.98(1)(b), (2)(a)-(b)) |
No notice if acquisition creates no material identity-theft/fraud risk or is good-faith employee/agent acquisition for lawful entity use (§ 134.98(2)(cm)) |
Subjects of PI held by WI-based or WI-maintaining/licensing entity; WI residents for out-of-state entity (§ 134.98(2)(a)-(b)) |
Reasonable time, no more than 45 days after entity learns of acquisition, subject to police request (§ 134.98(3)(a), (5)) |
No general state-regulator notice route stated in § 134.98; separate nationwide credit-agency notice at 1,000 people (§ 134.98(2)(a)-(br)) |
Single incident requiring 1,000+ individual notices: all nationwide agencies, without unreasonable delay; timing, distribution and content (§ 134.98(2)(br)) |
Mail or previously used communication method; otherwise method reasonably calculated for actual notice; say unauthorized acquisition occurred (§ 134.98(2)(a)-(b), (3)(b)) |
No fixed website/media substitute; if address cannot reasonably be found and no prior contact method, use method reasonably calculated for actual notice (§ 134.98(3)(b)) |
Law enforcement may request no notice/publicity; process begins after request period. Qualifying federal financial/privacy or HIPAA-compliant entities exempt (§ 134.98(3m), (5)) |
| Wyoming verified 2026-10-14 | Individual or commercial entity doing business in WY and owning/licensing residents’ computerized PI gives resident notice; nonowner holder tells business as soon as practicable after qualifying acquisition determination; parties may allocate notice, otherwise direct-relationship party gives it (§ 40-12-502(a),(g)) |
Unauthorized acquisition of computerized data materially compromising PI and causing/likely causing resident loss or injury; first/initial and last name plus unredacted § 6-3-901(b)(iii)–(xiv) element; lawfully public records/media excluded (§§ 40-12-501(a)(i),(vii),(b), 6-3-901(b)) |
Prompt good-faith investigation of misuse likelihood; resident notice if misuse occurred or is reasonably likely. Good-faith employee/agent acquisition excluded absent further unauthorized use/disclosure (§§ 40-12-501(a)(i), 40-12-502(a)) |
Affected WY resident when investigation finds misuse occurred or is reasonably likely; service provider first notifies business, and direct-relationship party gives resident notice if allocation unresolved (§ 40-12-502(a),(g)) |
As soon as possible, most expedient time possible and without unreasonable delay after investigation finds actual/likely misuse; investigation and system-restoration needs recognized; no fixed day ceiling (§ 40-12-502(a)) |
No separate AG breach-report duty, threshold, or clock in the general notice provision; AG may enforce violations (§ 40-12-502(a)–(h)) |
No separate agency breach notice in § 40-12-502; resident notice must provide a toll-free route to major credit-reporting agencies’ contact numbers and addresses (§ 40-12-502(e)(i)) |
Written or email notice; clear/conspicuous letter with collector/agency toll-free route, data types, incident description, approximate date if ascertainable, protective steps, vigilance advice, and known police-delay fact (§ 40-12-502(d)(i)–(ii),(e)) |
If cost >$10,000 or class >10,000 for WY-based entity; >$250,000 or >500,000 for other in-state operator; or insufficient contacts. Specific rule requires website posting if maintained AND major statewide media with toll-free inquiry number; definition also names available email (§§ 40-12-501(a)(x), 40-12-502(d)(iii)–(iv)) |
Written law-enforcement finding that notice may seriously impede criminal investigation permits delay; qualifying federal financial-institution or HIPAA notices satisfy § 40-12-502 (§ 40-12-502(b)–(c),(h)) |
All 51 jurisdictions verified. Each state page shows the statute text and verification date behind its row.
Have a specific situation?
A 50-state comparison shows the landscape. Ask your exact question and see what your state's law says for your facts, with citations.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace