Data Breach Notice to Residents and State Authorities in Wyoming
At a glance
| Covered entity and service provider | Individual or commercial entity doing business in WY and owning/licensing residents’ computerized PI gives resident notice; nonowner holder tells business as soon as practicable after qualifying acquisition determination; parties may allocate notice, otherwise direct-relationship party gives it (§ 40-12-502(a),(g)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized data materially compromising PI and causing/likely causing resident loss or injury; first/initial and last name plus unredacted § 6-3-901(b)(iii)–(xiv) element; lawfully public records/media excluded (§§ 40-12-501(a)(i),(vii),(b), 6-3-901(b)) |
| Risk screen or notice exception | Prompt good-faith investigation of misuse likelihood; resident notice if misuse occurred or is reasonably likely. Good-faith employee/agent acquisition excluded absent further unauthorized use/disclosure (§§ 40-12-501(a)(i), 40-12-502(a)) |
| Individuals who receive notice | Affected WY resident when investigation finds misuse occurred or is reasonably likely; service provider first notifies business, and direct-relationship party gives resident notice if allocation unresolved (§ 40-12-502(a),(g)) |
| Individual notice deadline and clock | As soon as possible, most expedient time possible and without unreasonable delay after investigation finds actual/likely misuse; investigation and system-restoration needs recognized; no fixed day ceiling (§ 40-12-502(a)) |
| Regulator threshold and deadline | No separate AG breach-report duty, threshold, or clock in the general notice provision; AG may enforce violations (§ 40-12-502(a)–(h)) |
| Consumer-reporting-agency notice | No separate agency breach notice in § 40-12-502; resident notice must provide a toll-free route to major credit-reporting agencies’ contact numbers and addresses (§ 40-12-502(e)(i)) |
| Individual delivery and content | Written or email notice; clear/conspicuous letter with collector/agency toll-free route, data types, incident description, approximate date if ascertainable, protective steps, vigilance advice, and known police-delay fact (§ 40-12-502(d)(i)–(ii),(e)) |
| Substitute notice conditions and channels | If cost >$10,000 or class >10,000 for WY-based entity; >$250,000 or >500,000 for other in-state operator; or insufficient contacts. Specific rule requires website posting if maintained AND major statewide media with toll-free inquiry number; definition also names available email (§§ 40-12-501(a)(x), 40-12-502(d)(iii)–(iv)) |
| Delays and alternate compliance | Written law-enforcement finding that notice may seriously impede criminal investigation permits delay; qualifying federal financial-institution or HIPAA notices satisfy § 40-12-502 (§ 40-12-502(b)–(c),(h)) |
Requirements one by one
The covered data and misuse screen
Section 40-12-501(a)(i) defines a breach as unauthorized acquisition of computerized data that materially compromises covered information and causes or is reasonably believed to cause loss or injury to a Wyoming resident. Section 40-12-502(a) then requires a reasonable and prompt, good-faith investigation of whether the information was or will be misused. Resident notice follows if misuse occurred or is reasonably likely. A worker's good-faith acquisition is excluded only while it is neither used nor further disclosed without authorization (§ 40-12-501(a)(i)).
Wyoming's personal-information definition is a name plus an unredacted element listed in § 6-3-901(b)(iii)–(xiv). That cross-reference reaches Social Security and license numbers, financial access combinations, government or tribal IDs, online credentials, medical and insurance information, biometrics, and taxpayer IDs. Lawfully public government-record or widely distributed-media information is excluded (§ 40-12-501(b)).
Timing and who sends the notice
Once the investigation finds actual or reasonably likely misuse, § 40-12-502(a) requires notice as soon as possible, in the most expedient time possible and without unreasonable delay. It recognizes measures needed to determine breach scope and restore system integrity but gives no numeric outer deadline. A nonowner holder reports actual or reasonably believed unauthorized acquisition to the business as soon as practicable following its determination (§ 40-12-502(g)). The holder and business may agree who sends resident notice; if they cannot agree, the one with the direct business relationship to the resident sends it.
Direct and substitute notice
Section 40-12-502(d) allows writing or email. Under subsection (e), notice must be clear and conspicuous and include a toll-free contact route, the information types involved, a general incident description, the approximate breach date if reasonably ascertainable, protective system steps, vigilance advice, and whether a law-enforcement investigation delayed notice if reasonably ascertainable.
Substitute notice is allowed if ordinary notice would cost more than $10,000 for a Wyoming-based entity or $250,000 for another operator in Wyoming; if the affected class exceeds 10,000 or 500,000, respectively; or if contact information is insufficient (§ 40-12-502(d)(iii)). The specific substitute-method clause requires website posting when a public site exists and major statewide media notice carrying a toll-free inquiry number (§ 40-12-502(d)(iv)). The definition in § 40-12-501(a)(x) also names email where addresses are available; it does not remove the specific website-and-media requirement.
What trips people up
The attorney general and credit agencies have different roles. Section 40-12-502(f) lets the attorney general enforce the notice rule, but § 40-12-502(a)–(h) does not prescribe a separate general breach report to that office or to consumer reporting agencies. The resident letter must instead give a toll-free route to major credit-reporting agencies' contact numbers and addresses (§ 40-12-502(e)(i)).
Police delay needs a written finding. Section 40-12-502(b) permits delayed notice when a law-enforcement agency determines in writing that notice may seriously impede a criminal investigation. The ordinary prompt-notice duty remains the baseline.
Common questions
Can a service provider send the resident letter? Yes. The holder and business may agree which one gives the notice required by § 40-12-502(a), but only one notice is required for each breach. Without agreement, the party with the direct resident relationship sends it (§ 40-12-502(g)).
Does a qualifying financial or health-care notice count? Section 40-12-502(c) treats specified compliant financial-institution notices as compliance, and subsection (h) does the same for a covered HIPAA entity or business associate that notifies affected Wyoming customers or entities under the cited federal rules.
Statutes and sources
- Wyo. Stat. § 40-12-501 — breach, personal-information and substitute-notice definitions. https://wyoleg.gov/statutes/compress/title40.pdf (accessed 2026-10-14)
- Wyo. Stat. § 6-3-901(b) — covered data elements incorporated by § 40-12-501. https://wyoleg.gov/statutes/compress/title06.pdf (accessed 2026-10-14)
- Wyo. Stat. § 40-12-502 — private-entity resident notice, methods, content, provider duties and delay. https://wyoleg.gov/statutes/compress/title40.pdf (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Wyoming law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Wyoming law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace