Data Breach Notice to Residents and State Authorities in Nevada
At a glance
| Covered entity and service provider | Data collector owning/licensing computerized PI notifies residents; nonowner maintainer notifies owner/licensee immediately on discovery (§§ 603A.030, 603A.220(1)-(2)) |
|---|---|
| Breach and covered information | Unauthorized acquisition materially compromising computerized PI; name plus SSN, ID, financial access, medical/insurance ID, or online credentials; unencrypted data (§§ 603A.020, 603A.040) |
| Risk screen or notice exception | Material compromise is part of breach definition; good-faith employee acquisition excluded absent unrelated use or unauthorized disclosure; no separate harm screen (§§ 603A.020, 603A.220(1)) |
| Individuals who receive notice | Nevada residents whose unencrypted PI was or reasonably is believed acquired by an unauthorized person (§ 603A.220(1)) |
| Individual notice deadline and clock | Most expedient time possible without unreasonable delay after discovery or notification; scope and integrity work allowed; no fixed outer day count (§ 603A.220(1)) |
| Regulator threshold and deadline | No general AG report under § 603A.220; subsection (6) instead adds nationwide reporting-agency notice above 1,000 people (§ 603A.220(1)-(7)) |
| Consumer-reporting-agency notice | More than 1,000 people notified at one time; each nationwide agency, without unreasonable delay, with notice distribution time and content (§ 603A.220(6)) |
| Individual delivery and content | Writing or qualifying electronic notice; § 603A.220 prescribes no itemized resident-letter content (§ 603A.220(1),(4)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 603A.220(4)(c)) |
| Delays and alternate compliance | Police investigation delay until clearance; timely own-policy or GLBA-compliant route; chapter-675 licensees excluded (§ 603A.220(3),(5),(7)) |
Requirements one by one
Breach and covered information
NRS § 603A.020 defines a breach as unauthorized acquisition of computerized data that materially compromises personal information. Good-faith employee or agent acquisition for the collector is excluded unless the information is used for an unrelated purpose or disclosed without authorization. Under § 603A.040, covered information includes a name with a Social Security number; Nevada driver's license, driver authorization, or identification number; financial account access data; medical or health-insurance ID; or online account credentials. The section excludes listed truncated numbers and lawfully public information.
Resident, owner, and reporting-agency notice
Under § 603A.220(1), a collector owning or licensing the data notifies Nevada residents whose unencrypted information was or is reasonably believed acquired by an unauthorized person. Notice is due in the most expedient time possible without unreasonable delay after discovery or notification, allowing scope and system-integrity work. The section gives no fixed outer day count. A nonowner maintainer tells the owner or licensee immediately following discovery under subsection (2).
If the collector determines notice must go to more than 1,000 people at one time, subsection (6) adds notice without unreasonable delay to nationwide consumer reporting agencies, stating when resident notice was distributed and its content. Section 603A.220 has no general Attorney General report.
Delivery and substitute notice
Section 603A.220(4) permits writing or qualifying electronic notice. Substitute notice is available if direct notice would cost over $250,000, the affected class exceeds 500,000, or contacts are insufficient. It requires email where addresses exist, a conspicuous website posting if the collector has a site, and major statewide media. The section does not enumerate required resident-letter contents.
What trips people up
The breach definition uses material compromise. Section 603A.020 contains that threshold. Section 603A.220 does not supply a separate investigation-based no-harm exception.
Police delay ends with notice. Under § 603A.220(3), notification may wait if a law-enforcement agency determines it would impede a criminal investigation. It must be made after the agency determines notice will no longer compromise it.
Alternate routes are conditional. Section 603A.220(5) recognizes a collector's own timely policy or compliance with GLBA privacy and security provisions. Subsection (7) excludes persons licensed under Nevada's chapter 675 from this section.
Common questions
Must Nevada's notice be sent by mail?
No. Section 603A.220(4) also permits qualifying electronic or substitute notice.
Does the 1,000-person threshold control resident notice?
No. Under § 603A.220(1) and (6), the threshold adds reporting-agency notice; it does not set the resident-notice trigger.
Statutes and sources
- NRS § 603A.020 — breach definition.
- NRS § 603A.030 — data collector.
- NRS § 603A.040 — personal information.
- NRS § 603A.220 — breach notice.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Nevada law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Nevada law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace