Data Breach Notice to Residents and State Authorities in Arkansas
At a glance
| Covered entity and service provider | Acquirer, owner, or licensee of computerized PI notifies residents; nonowner maintainer tells owner/licensee immediately after discovery (§ 4-110-105(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI compromising security/confidentiality/integrity; name plus SSN, Arkansas ID, financial access, medical information, or biometric data (§ 4-110-103(1),(7)) |
| Risk screen or notice exception | No notice after reasonable investigation finds no reasonable likelihood of customer harm; good-faith employee acquisition excluded absent misuse/disclosure (§§ 4-110-103(1), 4-110-105(d)) |
| Individuals who receive notice | Arkansas residents whose unencrypted PI was or reasonably is believed acquired by an unauthorized person (§ 4-110-105(a)(1)) |
| Individual notice deadline and clock | Most expedient time and manner possible without unreasonable delay after discovery/notification; scope and restoration work allowed; no fixed outer day limit (§ 4-110-105(a)(2)) |
| Regulator threshold and deadline | More than 1,000 affected individuals; § 105(b)(2) refers to nonowner-holder (b)(1); AG by affected-person disclosure or 45 days after reasonable-harm determination, whichever first (§ 4-110-105(b)(2)) |
| Consumer-reporting-agency notice | No separate nationwide consumer-reporting-agency notice in § 4-110-105; the extra statutory recipient is the AG under (b)(2) (§ 4-110-105(a)-(g)) |
| Individual delivery and content | Written or qualifying email notice; § 4-110-105 does not enumerate required resident-letter contents (§ 4-110-105(a),(e)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 4-110-105(e)(3)) |
| Delays and alternate compliance | Law-enforcement impediment until clearance; timely own-policy or qualifying stronger state/federal law; written determination/support kept five years and produced to AG within 30 days on written request (§§ 4-110-105(c),(f)-(g), 4-110-106) |
Requirements one by one
Breach and risk decision
Ark. Code § 4-110-103(1) defines a breach as unauthorized acquisition of computerized personal information that compromises security, confidentiality, or integrity. The definition excludes good-faith employee or agent acquisition for the holder's legitimate purposes if the information is not otherwise used or disclosed without authorization. Section 4-110-103(7) covers a name with a Social Security number, Arkansas license or identification number, financial account access data, or medical information; § 4-110-103(7)(E) added biometric data in 2019.
Under § 4-110-105(d), notice is unnecessary if a reasonable investigation finds no reasonable likelihood of harm to customers.
Residents, owners, and the Attorney General
Ark. Code § 4-110-105(a) requires notice to Arkansas residents whose unencrypted personal information was or reasonably is believed acquired by an unauthorized person. It must be made in the most expedient time and manner possible without unreasonable delay after discovery or notification, allowing necessary scope and system-restoration work. There is no fixed outer day count for residents. Under § 4-110-105(b)(1), a nonowner maintainer tells the owner or licensee immediately after discovery.
The Attorney General clause in § 4-110-105(b)(2) applies when more than 1,000 individuals are affected. Its text identifies the person or business required to make a disclosure under subsection (b)(1), the nonowner-holder paragraph. It calls for AG disclosure at the same time as disclosure to an affected individual or within 45 days after determining a reasonable likelihood of customer harm, whichever is first. Section 4-110-105 has no separate nationwide consumer-reporting-agency notice.
Delivery and substitute notice
Section 4-110-105(e) allows written or qualifying email notice. Substitute notice is allowed if direct delivery would cost over $250,000, the affected class exceeds 500,000, or contacts are insufficient. It requires email where addresses exist, a conspicuous website post if the holder has a site, and statewide media. The section does not enumerate resident-letter contents.
What trips people up
A police determination pauses notice. Under § 4-110-105(c), notice may be delayed when law enforcement finds it would impede a criminal investigation, then must be made after the agency says it will not compromise the investigation.
The documentation rule has its own clock. Section 4-110-105(g), added in 2019, requires a written breach determination and supporting documentation kept for five years. A written AG request starts a 30-day production deadline; the material is confidential.
Alternative compliance has a condition. Section 4-110-105(f) recognizes a holder's own notification policy if its timing is consistent with the Act and it follows that policy. Section 4-110-106 recognizes a state or federal law only if it provides greater personal-information protection and at least as thorough breach disclosure.
Common questions
Does the more-than-1,000 count refer only to Arkansas residents?
No. The words in § 4-110-105(b)(2) are “more than one thousand (1,000) individuals”; the paragraph does not limit that count to state residents.
Is a 45-day resident deadline stated?
No. Section 4-110-105(a)(2) sets a without-unreasonable-delay resident clock. The 45-day period appears in the Attorney General paragraph, subsection (b)(2).
Statutes and sources
- Ark. Code § 4-110-103 — definitions in the original Act.
- Ark. Code § 4-110-105 — 2019 Attorney General and documentation amendments; the 2005 Act supplies the other notice provisions.
- Ark. Code § 4-110-106 — alternate-law compliance.
Current official acts accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Arkansas law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Arkansas law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace