Data Breach Notice to Residents and State Authorities in Montana
At a glance
| Covered entity and service provider | MT-conducting person/business owning/licensing computerized PI tells residents; nonowner holder tells owner/licensee immediately after qualifying discovery (§ 30-14-1704(1)-(2)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI materially compromising security/confidentiality/integrity and causing or likely causing MT resident loss/injury; name plus SSN, state/tribal ID, financial access, medical, tax ID, or IRS identity PIN (§ 30-14-1704(4)) |
| Risk screen or notice exception | Breach definition requires actual/reasonably believed loss or injury; good-faith employee/agent business acquisition excluded absent further use/disclosure (§ 30-14-1704(4)(a)) |
| Individuals who receive notice | Montana resident whose unencrypted PI was or is reasonably believed acquired by unauthorized person; nonowner holder tells owner/licensee (§ 30-14-1704(1)-(2)) |
| Individual notice deadline and clock | Without unreasonable delay after discovery/notification, subject to lawful delay and scope/system-integrity measures; no fixed outside day count (§ 30-14-1704(1),(3)) |
| Regulator threshold and deadline | Every required individual notification triggers simultaneous electronic copy plus distribution date/method to AG consumer protection office; omit identities, give MT count if multiple recipients (§ 30-14-1704(8)) |
| Consumer-reporting-agency notice | If business's notice mentions obtaining a consumer-credit file, coordinate its timing, content and distribution with the agency without unreasonable individual delay; no numeric bureau-notice trigger (§ 30-14-1704(7)) |
| Individual delivery and content | Written, E-SIGN-consistent electronic, telephone, or eligible substitute; qualifying own information-security-policy notice also allowed; § 30-14-1704 states no general letter-content list (§ 30-14-1704(5)-(6)) |
| Substitute notice conditions and channels | Cost >$250,000, class >500,000, or insufficient contact; available email AND website posting if maintained, OR applicable local/statewide media (§ 30-14-1704(5)) |
| Delays and alternate compliance | Law-enforcement agency must determine criminal-investigation impediment and request delay; notify after clearance. Own policy route requires no unreasonable delay and notice under policy (§ 30-14-1704(3),(6)) |
Requirements one by one
The covered breach and recipients
Montana's § 30-14-1704(4) requires unauthorized acquisition of computerized data that materially compromises covered information and causes or is reasonably believed to cause loss or injury to a Montana resident. The listed identifiers include tribal identification cards, medical record information, taxpayer identification numbers, and IRS identity-protection PINs, in addition to Social Security and financial-access information.
The owner or licensee tells a Montana resident whose unencrypted information was or is reasonably believed acquired (§ 30-14-1704(1)). A nonowner holder tells the owner or licensee immediately following discovery when unauthorized acquisition happened or is reasonably believed to have happened (§ 30-14-1704(2)).
Timing and state notice
Resident notice follows discovery or notification of the breach without unreasonable delay. Section 30-14-1704(1) allows measures needed to determine the scope and restore the data system's reasonable integrity; it supplies no fixed outside day count. A qualifying law-enforcement delay ends when the agency determines notification will not compromise its criminal investigation (§ 30-14-1704(3)).
For every required individual notification, subsection (8) requires a simultaneous electronic copy to the attorney general's consumer protection office, together with the distribution date and method. The submission excludes personal identifiers; one copy can cover multiple people if it states how many Montana individuals received notice.
Delivery and credit-report references
Direct notice may be written, electronic under the cited federal electronic-signature rule, or telephonic (§ 30-14-1704(5)). A qualifying information-security policy may supply the notice procedure if it does not unreasonably delay notice and the entity follows it (§ 30-14-1704(6)). The section does not prescribe a general list of letter contents.
Substitute notice is allowed when ordinary delivery would cost more than $250,000, the affected class exceeds 500,000, or contact information is insufficient. Subsection (5)(b) phrases the channels as available email and website posting if maintained, or notice to applicable local or statewide media.
If a business's notice tells a person they may obtain a file from a consumer credit-reporting agency, subsection (7) requires coordination with the agency over the notice's timing, content and distribution. That coordination cannot unreasonably delay individual notice.
What trips people up
The attorney-general route has no headcount floor. Section 30-14-1704(8) ties it to any required individual notification, even one recipient. The simultaneous submission requirement is separate from subsection (7)'s credit-agency coordination.
The own-policy route still has a timing limit. Subsection (6) treats policy-compliant notice as compliant only if the person or business does not unreasonably delay it.
Common questions
Does merely viewing data count as this statutory breach?
The definition in § 30-14-1704(4)(a) requires unauthorized acquisition, material compromise, and actual or reasonably believed loss or injury.
May the copy sent to the attorney general list affected people?
No. Section 30-14-1704(8) directs the sender to exclude information that personally identifies those entitled to notice.
Must a business always send a separate notice to nationwide credit bureaus?
Subsection (7) instead requires coordination when an individual notice refers to obtaining a consumer credit file; it states no separate numeric bureau-notice trigger.
Statutes and sources
- Mont. Code Ann. § 30-14-1704 — breach test, recipient notices, delivery, and delays.
Current official Montana Code Annotated checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Montana law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Montana law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace