Data Breach Notice to Residents and State Authorities in Pennsylvania

At a glance

Requirements one by one

Breach and covered information

The breach definition in § 2 requires both unauthorized access and acquisition of computerized data, material compromise, and loss or injury that has occurred or is reasonably believed likely to occur. Covered personal information generally joins a name with an unencrypted, unredacted listed identifier, financial credential, health-insurance item, or online account credential. A worker's good-faith access for the entity is excluded only while there is no unrelated use or further unauthorized disclosure.

Residents and timing

Under § 3(a), the entity tells residents whose unencrypted, unredacted data was or is reasonably believed accessed and acquired. It may use a principal Pennsylvania mailing address in its data to determine residence. The notice clock begins after determination, which § 2 defines as verification or reasonable certainty; discovery is only knowledge or reasonable suspicion. Notice must follow without unreasonable delay, allowing necessary scope and system-restoration work and the § 4 law-enforcement exception.

Attorney General and reporting agencies

Section 3(c.1) requires concurrent Attorney General notice when more than 500 Pennsylvania individuals must receive notice. The submission states, to the extent known, the organization's name and location, breach date, incident summary, total affected count, and Pennsylvania affected count. Section 3(c.2) exempts an entity subject to the insurance data security chapter from that Attorney General route. Separately, § 5 triggers nationwide consumer-reporting-agency notice when more than 500 persons are notified at one time; it calls for timing, distribution, and number of notices without unreasonable delay.

Delivery and substitute notice

Section 2 permits mail, a qualifying phone call, or email when there is a prior business relationship and a valid address. For an online-credential breach, § 3(a.3) permits electronic or other notice directing an account change if sufficient contact information exists. Substitute notice becomes available when direct notice would cost over $100,000, the affected class exceeds 175,000, or contacts are insufficient. Once used, its available-email, website-if-maintained, and statewide-media channels are all required.

What trips people up

A vendor's notice goes first to its customer. Section 3(c) requires a vendor holding another entity's data to notify that entity after discovery; the customer makes the breach determination and discharges remaining duties.

Encrypted data can still count. Section 3(b) requires notice if the data was accessed and acquired unencrypted, the breach is linked to compromised encryption, or the person involved had the key.

Credit monitoring is conditional. If § 5 reporting-agency notice applies and the entity reasonably believes a name plus a Social Security, bank-account, driver's-license, or state-ID number was accessed, § 5.4 requires a qualifying credit report and 12 months of monitoring or notice of its no-cost availability.

Police delay needs a written finding. Under § 4, the agency must advise the entity in writing, specifically citing that section, that notice would impede a criminal or civil investigation. Notice follows when the agency determines it will no longer compromise the investigation or national or homeland security.

Common questions

Can an entity use its own notice policy? Yes, if the policy is consistent with the Act's notice requirements and the entity follows it (§ 7(a)). Specified financial-institution and regulator procedures can also satisfy the Act (§ 7(b)).

Does health-data compliance offer another route? A covered entity or business associate meeting the federal privacy and security standards named in § 5.3 is deemed compliant with this Act.

Statutes and sources

• Breach of Personal Information Notification Act §§ 2-5, 5.3-5.4, 7 (73 P.S. §§ 2302-2305, 2305.3-2305.4, 2307) — definitions, notices, methods, delays, and compliance routes. https://www.legis.state.pa.us/WU01/LI/LI/US/HTM/2005/0/0094..HTM (accessed 2026-10-14)