Data Breach Notice to Residents and State Authorities in Wisconsin
At a glance
| Covered entity and service provider | In-state business, licensee, resident account holder or lender; nonowner storer without owner contract notifies owner as soon as practicable (§ 134.98(1)(a), (2)(bm)) |
|---|---|
| Breach and covered information | Known unauthorized acquisition of name plus unprotected SSN, ID, financial-account/access, DNA profile or biometric data; no computerized-data limit stated (§ 134.98(1)(b), (2)(a)-(b)) |
| Risk screen or notice exception | No notice if acquisition creates no material identity-theft/fraud risk or is good-faith employee/agent acquisition for lawful entity use (§ 134.98(2)(cm)) |
| Individuals who receive notice | Subjects of PI held by WI-based or WI-maintaining/licensing entity; WI residents for out-of-state entity (§ 134.98(2)(a)-(b)) |
| Individual notice deadline and clock | Reasonable time, no more than 45 days after entity learns of acquisition, subject to police request (§ 134.98(3)(a), (5)) |
| Regulator threshold and deadline | No general state-regulator notice route stated in § 134.98; separate nationwide credit-agency notice at 1,000 people (§ 134.98(2)(a)-(br)) |
| Consumer-reporting-agency notice | Single incident requiring 1,000+ individual notices: all nationwide agencies, without unreasonable delay; timing, distribution and content (§ 134.98(2)(br)) |
| Individual delivery and content | Mail or previously used communication method; otherwise method reasonably calculated for actual notice; say unauthorized acquisition occurred (§ 134.98(2)(a)-(b), (3)(b)) |
| Substitute notice conditions and channels | No fixed website/media substitute; if address cannot reasonably be found and no prior contact method, use method reasonably calculated for actual notice (§ 134.98(3)(b)) |
| Delays and alternate compliance | Law enforcement may request no notice/publicity; process begins after request period. Qualifying federal financial/privacy or HIPAA-compliant entities exempt (§ 134.98(3m), (5)) |
Requirements one by one
Who and what the rule covers
Wis. Stat. § 134.98(1)(a) defines a covered entity to include a business that operates in Wisconsin and maintains personal information, a licensee of that information in the state, and certain resident account holders and lenders. Section 134.98(1)(b) covers a name linked to an unprotected Social Security or state ID number, financial-account or access data, a DNA profile, or unique biometric data. Its notice trigger is known unauthorized acquisition, without a computerized-record condition.
Under § 134.98(2)(a)-(b), an in-state or Wisconsin data-holding entity makes reasonable efforts to notify each affected subject; an out-of-state entity notifies affected Wisconsin residents. A nonowner storer of a Wisconsin resident's information who has no contract with the owner or licensee must notify that owner or licensee as soon as practicable under subsection (2)(bm).
Risk screen and clocks
Section 134.98(2)(cm) excuses notice if the acquisition creates no material risk of identity theft or fraud, or if an employee or agent acquired the information in good faith for lawful entity use. The provision does not impose an express written-decision retention period.
Otherwise, subsection (3)(a) gives a reasonable-time clock, capped at 45 days after the entity learns of the acquisition. The number of notices and available communication methods factor into reasonableness. For a single incident requiring notice to 1,000 or more individuals, subsection (2)(br) adds notice to all nationwide consumer reporting agencies without unreasonable delay, stating the timing, distribution, and content of individual notices.
Delivery and contents
Under § 134.98(3)(b), notice may go by mail or a method previously used to communicate with the person. If no mailing address can be found with reasonable diligence and there was no prior communication method, the entity must use a method reasonably calculated to provide actual notice. Section 134.98(2)(a)-(b) requires the notice to say that the entity knows of unauthorized acquisition of that person's information. Upon a recipient's written request, the entity identifies the information acquired under subsection (3)(c).
What trips people up
A law-enforcement request can stop publicity. Under § 134.98(5), an agency may ask the entity to withhold notice to protect an investigation or homeland security. The notification process starts when the requested period ends; during it, the entity may not notify or publicize the incident except as that agency authorizes.
The federal-regulation exclusions are conditional. Section 134.98(3m) excludes an entity complying with the specified federal financial privacy and security requirements, or its contract partner with a breach policy, and an entity covered by and complying with the cited HIPAA regulations.
Common questions
Must the entity notify the Wisconsin Attorney General?
Section 134.98(2) directs notices to affected people, certain data owners, and nationwide consumer reporting agencies at the stated threshold. It does not set a general Attorney General reporting step.
Does the notice have to list every compromised data element?
The initial notice must identify the known unauthorized acquisition under § 134.98(2)(a)-(b). Section 134.98(3)(c) separately requires the entity to identify the acquired personal information upon the recipient's written request.
Statutes and sources
- Wis. Stat. § 134.98 — definitions, notice duties, exceptions, timing, methods, and law-enforcement request.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Wisconsin law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Wisconsin law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace