Security Breach Notification Laws

All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses, and in most states, governmental entities as well, to notify individuals of security breaches of information involving personally identifiable information.

Security breach laws typically have provisions regarding who must comply with the law (e.g., businesses, data or information brokers, government entities, etc.); definitions of “personal information” (e.g., name combined with SSN, drivers license or state ID, account numbers, etc.); what constitutes a breach (e.g., unauthorized acquisition of data); requirements for notice (e.g., timing or method of notice, who must be notified); and exemptions (e.g., for encrypted information).

PLEASE NOTE: NCSL serves state legislators and their staff. This site provides general comparative information only and should not be relied upon or construed as legal advice. 

*Some states have additional statutory cybersecurity reporting requirements wherein a cybersecurity incident, as defined, must be reported to a central state agency.

This chart does not include state statutes requiring notification of breaches of student data. 

Additional Resources

• Consumer report security freeze laws
• Data disposal laws
• Security Breach homepage
• Security breach overview (including links to past years' introduced and enacted legislation)