Data Breach Notice to Residents and State Authorities in Florida
At a glance
| Covered entity and service provider | Commercial covered entity acquiring, keeping, or using personal information; contracted third-party agent tells entity as soon as practicable and ≤10 days after determination/reason (§ 501.171(1)(b),(h), (6)) |
|---|---|
| Breach and covered information | Unauthorized access to electronic data with personal information; name plus listed identifiers, health, biometric or geolocation data, or online credentials; publicly available or unusable encrypted data excluded (§ 501.171(1)) |
| Risk screen or notice exception | No individual notice after appropriate investigation and law-enforcement consultation finds no likely identity theft/financial harm; document 5 years and send determination to department within 30 days (§ 501.171(4)(c)) |
| Individuals who receive notice | Each person in Florida whose personal information was or is reasonably believed accessed in the breach (§ 501.171(4)(a)) |
| Individual notice deadline and clock | As practicable, without unreasonable delay, and by day 30 after breach determination or reason to believe it occurred; specified delay/waiver applies (§ 501.171(4)(a)-(c)) |
| Regulator threshold and deadline | Department of Legal Affairs at ≥500 Florida individuals, as practicable and by day 30 after determination/reason; written synopsis, count, services, consumer-notice action, and contact (§ 501.171(3)) |
| Consumer-reporting-agency notice | More than 1,000 people notified at one time: also notify all nationwide consumer-reporting agencies of timing, distribution and content, without unreasonable delay (§ 501.171(5)) |
| Individual delivery and content | Mail to recorded address or email to recorded address; include breach date/range, affected information, and entity contact route (§ 501.171(4)(d)-(e)) |
| Substitute notice conditions and channels | Direct notice infeasible because cost >$250,000, affected people >500,000, or no mail/email address; website if maintained plus print and broadcast media in affected urban/rural areas (§ 501.171(4)(f)) |
| Delays and alternate compliance | Written police request sets individual-notice delay; timely written good-cause request may add 15 days for individual notice; qualifying federal-regulator notice route with timely department copy (§ 501.171(3)(a), (4)(b),(g)) |
Requirements one by one
Covered access and information
Florida's § 501.171(1)(a) defines a breach by “unauthorized access” to electronic data containing personal information. Subsection (1)(g) includes name-plus-identifier, medical, biometric, and geolocation combinations, as well as online-account credentials. It excludes information made public by a government body and information secured so that it is unusable or no longer personally identifying.
The individual and department clocks
Both ordinary clocks run from determination of the breach or reason to believe it occurred. Section 501.171(4)(a) requires individual notice as expeditiously as practicable, without unreasonable delay, and within 30 days. Subsection (3)(a) imposes the same outer period for Department of Legal Affairs notice when at least 500 people in Florida are affected. The department report is written and includes the incident synopsis, in-state count, any free services, consumer-notice action, and a named contact (§ 501.171(3)(b)).
Documented no-notice decision
Under § 501.171(4)(c), the covered entity must first make an appropriate investigation and consult relevant law enforcement. If it then reasonably finds the breach has not and will not likely cause identity theft or other financial harm, it may omit individual notice. The finding must be written, kept for at least five years, and sent to the department within 30 days after the determination.
Delivery and substitute notice
Direct individual notice goes by mail or email to the address in the entity's records. Section 501.171(4)(e) requires the breach date or estimated range, a description of affected information, and a way to contact the entity. If direct notice is infeasible because its cost exceeds $250,000, the affected class exceeds 500,000, or no mail or email address is held, subsection (4)(f) requires website notice if the entity has a site and print and broadcast media notice covering affected urban and rural areas.
What trips people up
The third-party agent has a separate handoff clock. A contracted agent with a breach in its system must tell the covered entity as expeditiously as practicable and no later than 10 days after determination or reason to believe there was a breach (§ 501.171(6)(a)). The covered entity then handles the individual and department notices.
The possible 15-day extension is for individual notice. Subsection (3)(a) allows that extra time upon good cause given to the department in writing within the original 30 days. It does not move the department's own 30-day reporting limit.
Credit-agency notice uses a different count. More than 1,000 people notified at one time triggers notice to all nationwide consumer-reporting agencies about the timing, distribution, and content of the notices (§ 501.171(5)). The department threshold is 500 people in Florida.
Common questions
Can the agent send the required public notices for the covered entity? Yes. Section 501.171(6)(b) permits an agent to send the subsection (3) and (4) notices, but treats the agent's improper notice as the covered entity's violation.
What supporting records may the department request? Section 501.171(3)(c) names a police, incident, or computer-forensics report, breach policies, and steps taken to rectify the breach.
Statutes and sources
- Fla. Stat. § 501.171 — private-entity breach definition and individual, department, agent, and credit-agency notice. https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Florida law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Florida law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace