Data Breach Notice to Residents and State Authorities in Mississippi
At a glance
| Covered entity and service provider | Person doing business in MS that ordinarily owns, licenses, or maintains resident PI; nonowner maintainer tells owner/licensee as soon as practicable after discovery when fraudulent acquisition is involved (§ 75-24-29(1),(4)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unsecured electronic PI; name plus SSN, driver/state ID, or financial-account access; public information excluded (§ 75-24-29(2)) |
| Risk screen or notice exception | No notice after appropriate investigation reasonably finds breach unlikely to harm affected people (§ 75-24-29(3)) |
| Individuals who receive notice | MS residents whose PI was or reasonably is believed intentionally acquired without authorization (§ 75-24-29(2),(3)) |
| Individual notice deadline and clock | Without unreasonable delay after investigation for scope, affected people, or integrity; no fixed outer day count (§ 75-24-29(3)) |
| Regulator threshold and deadline | No general AG filing in § 75-24-29; AG enforces violations, and 2025-2026 proposed reporting bills died (§ 75-24-29(8)) |
| Consumer-reporting-agency notice | No separate nationwide consumer-reporting-agency notice in § 75-24-29 (§ 75-24-29(1)-(8)) |
| Individual delivery and content | Writing, telephone, qualifying electronic notice; no itemized resident-letter contents in § 75-24-29 (§ 75-24-29(3),(6)) |
| Substitute notice conditions and channels | Cost over $5,000, class over 5,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 75-24-29(6)) |
| Delays and alternate compliance | Requested law-enforcement delay for criminal investigation or national security until clearance; timely own-policy or primary-regulator-policy route (§ 75-24-29(5),(7)) |
Requirements one by one
Breach, covered data, and harm decision
Miss. Code § 75-24-29(2) defines a breach as unauthorized acquisition of unsecured electronic personal information. Covered combinations are a name with a Social Security number, driver's license or state ID number, or financial-account data plus access information. Lawfully public information is excluded. An affected individual is a Mississippi resident whose information was or reasonably is believed intentionally acquired by an unauthorized person.
Under § 75-24-29(3), an appropriate investigation may support a reasonable finding that the breach is unlikely to harm affected people. In that case, resident notice is unnecessary.
Resident and owner notice
Section 75-24-29(3) requires notice to all affected people without unreasonable delay after the permitted investigation to identify scope and recipients or restore reasonable system integrity. It has no fixed outer day limit. A nonowner maintainer tells the owner or licensee as soon as practicable after discovery under subsection (4), when the information was or likely was acquired without authorization for fraudulent purposes.
Section 75-24-29 does not require a separate Attorney General report or nationwide consumer-reporting-agency report. Its subsection (8) assigns enforcement to the Attorney General.
Methods and substitute notice
Section 75-24-29(6) permits writing, telephone, or qualifying electronic notice. Substitute notice is available if direct notice would cost more than $5,000, the affected class exceeds 5,000, or contacts are insufficient. It requires email where addresses exist, a conspicuous website post if the business has a site, and major statewide media. The section does not itemize resident-letter contents.
What trips people up
The small substitute thresholds are cumulative channels. The $5,000 and 5,000-person numbers are alternative eligibility tests; the email, website, and media steps are all required when applicable under § 75-24-29(6).
Police delay requires a request. Section 75-24-29(5) permits delay if law enforcement finds notice would impede a criminal investigation or national security and requests it. Notice follows when the agency determines the risk has ended and tells the holder.
An own-policy route still has a timing condition. Section 75-24-29(7) recognizes notice under the holder's own security-breach procedures, or qualifying primary-regulator procedures, if the stated conditions are met.
Common questions
Does Mississippi impose a 30-day resident deadline?
No. Section 75-24-29(3) says without unreasonable delay and allows the stated investigation, but gives no fixed outer day count.
Is every data exposure a breach under this section?
No. Section 75-24-29(2) requires unauthorized acquisition of unsecured electronic information within its definition.
Statutes and sources
- Miss. Code § 75-24-29 — breach definition, resident notice, and exceptions.
Current official code text and later legislation checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Mississippi law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Mississippi law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace