Data Breach Notice to Residents and State Authorities in Illinois
At a glance
| Covered entity and service provider | Owner/licensee data collector gives resident notice; nonowner custodian tells owner/licensee immediately after discovery and cooperates (§§ 5, 10(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of compromised computerized data; name plus listed identifiers, health or biometric data, or online credentials, including readable key-compromised data (§ 5) |
| Risk screen or notice exception | Good-faith employee/agent acquisition for a legitimate purpose excluded unless misused or further disclosed; § 5 has no separate harm test |
| Individuals who receive notice | Illinois residents whose covered information was involved in an owner's or licensee's breach; custodian notice goes to owner/licensee (§ 10(a)-(b)) |
| Individual notice deadline and clock | After discovery or notification, most expedient time possible and without unreasonable delay; scope and system-restoration measures allowed (§ 10(a)) |
| Regulator threshold and deadline | More than 500 Illinois residents owed notice from one breach: Attorney General without unreasonable delay and no later than resident notice; three incident items (§ 10(e)) |
| Consumer-reporting-agency notice | No separate private-collector duty in § 10; § 12(d)'s more-than-1,000-person agency duty applies to State agencies |
| Individual delivery and content | Written or qualifying electronic notice; identity-data notice lists credit agencies, FTC, and fraud-alert/freeze information; credential notice may direct account changes (§ 10(a), (c)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 500,000, or insufficient contacts; available email, website if maintained, and statewide or qualifying local media together (§ 10(c)(3)) |
| Delays and alternate compliance | Written law-enforcement request when notice would interfere with criminal investigation; timely own-policy route; compliant HIPAA route with conditional AG notice (§§ 10(b-5), (d), 50) |
Requirements one by one
Covered breach and information
Section 5 defines a breach as unauthorized acquisition of computerized data compromising the security, confidentiality, or integrity of personal information. A name with listed identifiers, financial data, medical or insurance information, or authentication biometrics is covered; online credentials form a separate route. Encrypted or redacted data still counts when the key to read it was acquired without authorization.
Resident and Attorney General clocks
Under § 10(a), an owner or licensee sends free resident notice after discovery or notification, in the “most expedient time possible and without unreasonable delay.” Necessary scope and system-restoration work may affect the timing. If more than 500 Illinois residents must receive notice from a single breach, § 10(e) also requires an Attorney General notice by the time residents are notified. It gives the nature of the incident, Illinois-resident count, and steps taken or planned. If the breach date is initially unknown, that date follows as soon as possible.
Delivery and content
Section 10(c) allows writing or electronic delivery satisfying the federal electronic-records provision. For name-plus-data breaches, § 10(a)(1) calls for consumer-reporting-agency and FTC contact information plus a statement about fraud-alert and security-freeze information. For online credentials, § 10(a)(2) allows a notice directing changes to shared credentials across accounts. A resident notice must not state the number of affected Illinois residents.
Substitute notice
When direct delivery would cost more than $250,000, the affected class exceeds 500,000, or contacts are insufficient, § 10(c)(3) permits substitute notice. It requires all applicable channels: available email, a conspicuous website posting if the collector has a site, and statewide media or qualifying local media for a geographically concentrated breach.
What trips people up
The custodian does not take over the resident notice. Section 10(b) requires a nonowner collector to notify the owner or licensee immediately after discovery when covered information was or is reasonably believed acquired without authorization. The custodian must cooperate about the date, nature, and response steps, but need not notify residents itself.
The reporting-agency rule is in the State-agency section. Section 12(d) requires nationwide agency notice after a State agency notifies more than 1,000 people. The private-collector section, § 10, instead requires residents and, above its threshold, the Attorney General.
A police delay needs writing. Section 10(b-5) requires a written request from an appropriate law-enforcement agency that determines notice would interfere with a criminal investigation. Resident notice resumes as soon as it no longer interferes.
Common questions
Can a collector use its existing breach-notice policy? Section 10(d) deems a policy compliant if its timing meets the Act and the collector notifies people under that policy.
What if the collector follows the federal health-data rules? A qualifying covered entity or business associate is deemed compliant under § 50. If it must notify the federal health secretary, it must also notify the Illinois Attorney General within five business days of that notice.
Statutes and sources
- 815 ILCS 530/5, 10, 12(d), 50 — covered data, private and State-agency notices, and the health-data route. https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67&Print=True (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Illinois law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Illinois law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace