Data Breach Notice to Residents and State Authorities in Louisiana
At a glance
| Covered entity and service provider | Owner/licensee of computerized PI notifies residents; nonowner maintainer notifies owner/licensee after discovery (§ 51:3074(C)-(D)) |
|---|---|
| Breach and covered information | Compromised computerized data reasonably likely to cause unauthorized acquisition AND access; name plus SSN, ID, financial access, passport or biometric data (§ 51:3073(2),(4)) |
| Risk screen or notice exception | No notice after reasonable no-likelihood-of-harm finding; written determination/support retained 5 years from discovery and sent to AG on written request (§ 51:3074(I)) |
| Individuals who receive notice | LA residents whose PI was or is reasonably believed acquired by unauthorized person (§ 51:3074(C)) |
| Individual notice deadline and clock | Most expedient time, without unreasonable delay; generally within 60 days from breach discovery, with documented extension route (§ 51:3074(E)) |
| Regulator threshold and deadline | When resident notice required: AG Consumer Protection Section written report naming affected LA citizens; receipt within 10 days after resident notices is timely (LAC 16:III § 701(A)-(B)) |
| Consumer-reporting-agency notice | No general nationwide credit-agency report stated in §§ 51:3073–3074 or LAC 16:III § 701; AG report is separate (§ 51:3074; LAC 16:III § 701) |
| Individual delivery and content | Written or qualifying electronic notice; § 51:3074 specifies no itemized resident-letter content (§ 51:3074(C),(G)) |
| Substitute notice conditions and channels | Cost over $100,000, class over 100,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 51:3074(G)(3)) |
| Delays and alternate compliance | Police impediment or incident-scope/system measures may delay; written reasons to AG within 60 days for extension; timing-consistent own policy route (§ 51:3074(E)-(F),(H)) |
Requirements one by one
Covered information and risk decision
La. R.S. § 51:3073(2) defines a breach as a compromise of computerized data that results in, or is reasonably likely to result in, unauthorized acquisition and access to personal information. Subsection (4) covers a Louisiana resident's name paired with a Social Security or state ID number, financial-account access data, passport number, or biometric authentication data when the name or element is not encrypted or redacted. Good-faith employee acquisition for business purposes is excluded under subsection (2) when the information is not used for or subject to unauthorized disclosure.
Under § 51:3074(C), the owner or licensee notifies residents whose information was or is reasonably believed acquired without authorization. Subsection (I) excuses notice if a reasonable investigation finds no reasonable likelihood of harm. The business retains its written determination and supporting documents for five years from discovery and sends them to the Attorney General within 30 days of a written request.
Resident, owner, and Attorney General clocks
Section 51:3074(D) requires a nonowner data maintainer to notify the owner or licensee following discovery when information was or was reasonably believed acquired. Both owner-to-resident and maintainer-to-owner notice must be made in the most expedient time possible without unreasonable delay, generally no later than 60 days after breach discovery under subsection (E).
When resident notice is required, LAC 16:III § 701(A)-(B) calls for a written report to the Attorney General's Consumer Protection Section detailing the breach and naming all affected Louisiana citizens. It treats a report received within 10 days after resident notices are distributed as timely. The general statutory and regulatory provisions do not create a separate nationwide consumer reporting agency notice route.
Delivery and substitute notice
Section 51:3074(G) permits written or qualifying electronic notice. If direct notice would cost more than $100,000, the affected class exceeds 100,000, or contacts are insufficient, substitute notice must use all applicable channels: email where addresses exist, a conspicuous website post if a site is maintained, and major statewide media.
What trips people up
A delay beyond 60 days requires written reasons. Under § 51:3074(E), law-enforcement delay or necessary scope, further-disclosure, or system-restoration work can extend the clock. The business or agency must provide written reasons to the Attorney General within the initial 60 days; the Attorney General then allows a reasonable extension. Subsection (F) ends a police delay when the agency finds notice no longer compromises its investigation.
A policy route still has a timing condition. Subsection (H) treats a business as compliant with notification requirements if it follows its own information-security notice policy and that policy is consistent with statutory timing.
Common questions
Is every breach reportable to residents even if no harm is likely?
No. Section 51:3074(I) permits a documented no-notice determination after a reasonable no-likelihood-of-harm finding, with five-year retention.
Is the Attorney General's 10-day clock counted from discovery?
No. LAC 16:III § 701(B) treats receipt within 10 days after distribution of resident notices as timely. The separate 60-day resident clock in § 51:3074(E) starts with discovery.
Statutes and sources
- La. R.S. § 51:3073 — breach and personal-information definitions.
- La. R.S. § 51:3074 — private notice, risk screen, delivery, and delays.
- LAC 16:III § 701 — official Attorney General page reproducing the regulator-report rule.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Louisiana law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Louisiana law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace