Security Breach Notification Laws

1/17/2022

All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses, and in most states, governmental entities as well, to notify individuals of security breaches of information involving personally identifiable information.

Security breach laws typically have provisions regarding who must comply with the law (e.g., businesses, data or information brokers, government entities, etc.); definitions of “personal information” (e.g., name combined with SSN, drivers license or state ID, account numbers, etc.); what constitutes a breach (e.g., unauthorized acquisition of data); requirements for notice (e.g., timing or method of notice, who must be notified); and exemptions (e.g., for encrypted information).

PLEASE NOTE: NCSL serves state legislators and their staff. This site provides general comparative information only and should not be relied upon or construed as legal advice. 

State Applies to Private Sector Applies to Government*
Alabama Ala. Code § 8-38-1 et seq.  Ala. Code § 8-38-1 et seq. 

Alaska

Alaska Stat. § 45.48.010 et seq.

Alaska Stat. § 45.48.010 et seq.

Arizona

Ariz. Rev. Stat. § 18-551 to -552

Ariz. Rev. Stat. § 18-551 to -552

Arkansas

Ark. Code §§ 4-110-101 et seq.

Ark. Code §§ 4-110-101 et seq.

California

Cal. Civ. Code § 1798.82

Cal. Civ. Code § 1798.29

Colorado

Colo. Rev. Stat. § 6-1-716

Colo. Rev. Stat. § 24-73-103

Connecticut

Conn. Gen Stat. §§ 36a-701b, 4e-70

Conn. Gen Stat. § 4e-70 (state contractors)

Delaware

Del. Code tit. 6, § 12B-101 et seq.

Del. Code tit. 6, § 12B-101 et seq.

Florida

Fla. Stat. § 501.171

Fla. Stat. § 501.171

Georgia

Ga. Code §§ 10-1-910 to -912; 46-5-214

Ga. Code §§ 10-1-910 to -912

Hawaii

Haw. Rev. Stat. § 487N-1 et seq.

Haw. Rev. Stat. § 487N-1 et seq.

Idaho

Idaho Stat. §§ 28-51-104 to -107

Idaho Stat. §§ 28-51-104 to -107

Illinois

815 ILCS §§ 530/1 to 530/25, 815 ILCS 530/

815 ILCS §§ 530/1 to 530/25, 815 ILCS 530/

Indiana

Ind. Code § 24-4.9 et seq.

Ind. Code § 4-1-11 et seq.

Iowa

Iowa Code §§ 715C.1, 715C.2

Iowa Code §§ 715C.1, 715C.2

Kansas

Kan. Stat. § 50-7a01 et seq. 

Kan. Stat. § 50-7a01 et seq. 
Kentucky KRS § 365.732 KRS § 365.732, KRS § 61.931 to .934

Louisiana

La. Rev. Stat. §§ 51:3071 et seq.

La. Rev. Stat. §§ 51:3071 et seq.

Maine

Me. Rev. Stat. tit. 10 § 1346 et seq.

Me. Rev. Stat. tit. 10 § 1346 et seq.

Maryland

Md. Code Com. Law § 14-3504

Md. State Govt. Code § 10-1305

Massachusetts

Mass. Gen. Laws § 93H-1 et seq.

Mass. Gen. Laws § 93H-1 et seq.

Michigan

Mich. Comp. Laws §§ 445.63, 445.72

Mich. Comp. Laws §§ 445.63, 445.72

Minnesota

Minn. Stat. §§ 325E.61, 325E.64

Minn. Stat. § 13.055

Mississippi

Miss. Code § 75-24-29

 

Missouri

Mo. Rev. Stat. § 407.1500

Mo. Rev. Stat. § 407.1500

Montana

Mont. Code §§ 30-14-1704, 33-19-321

Mont. Code §§ 2-6-1501 to -1503

Nebraska

Neb. Rev. Stat. §§ 87-801 et seq.

Neb. Rev. Stat. §§ 87-801 et seq.

Nevada

Nev. Rev. Stat. §§  603A.010 et seq.

Nev. Rev. Stat. §§  603A.010 et seq., 242.183

New Hampshire

N.H. Rev. Stat. §§ 359-C:19, 359-C:20, 359-C:21

N.H. Rev. Stat. §§ 359-C:19, 359-C:20, 359-C:21

New Jersey

N.J. Stat. § 56:8-161, 163

N.J. Stat. § 56:8-161, 163
New Mexico N.M. Stat. §§ 57-12C-1  

New York

N.Y. Gen. Bus. Law § 899-AA

NY CLS State Tech. Law § 208

North Carolina

N.C. Gen. Stat § 75-61, § 75-65

 

North Dakota

N.D. Cent. Code §§ 51-30-01 et seq.

N.D. Cent. Code §§ 54-59.1-01 et seq.

Ohio

Ohio Rev. Code §§ 1349.19, 1349.1911345.01 et seq.

Ohio Rev. Code §§ 1347.121349.192

Oklahoma

Okla. Stat. §§ 24-161 to -166

Okla. Stat. § 74 -3113.1

Oregon

Oregon Rev. Stat. §§ 646A.600 to .628

 

Pennsylvania

73 Pa. Stat. §§ 2301 et seq.

73 Pa. Stat. §§ 2301 et seq.

Rhode Island

R.I. Gen. Laws §§ 11-49.3-1 et seq.

R.I. Gen. Laws §§ 11-49.3-1 et seq.

South Carolina

S.C. Code § 39-1-90

S.C. Code § 1-11-490
South Dakota S.D. Cod. Laws §§ 20-40-19 to -26

 

Tennessee

Tenn. Code §§  47-18-2107

Tenn. Code §§  47-18-2107; 8-4-119

Texas

Tex. Bus. & Com. Code §§ 521.002, 521.053

Tex. Govt. Code § 2054.1125

Utah

Utah Code §§ 13-44-101 et seq., 80 78B-4-701 et seq.

 

Vermont

Vt. Stat. tit. 9 §§ 2430, 2435

Vt. Stat. tit. 9 §§ 2430, 2435

Virginia

Va. Code §§ 18.2-186.6, 32.1-127.1:05

Va. Code §§ 18.2-186.6, 32.1-127.1:05

Washington

Wash. Rev. Code §§ 19.255.010

Wash. Rev. Code § 42.56.590

West Virginia

W.V. Code §§ 46A-2A-101 et seq.

W.V. Code §§ 46A-2A-101 et seq.

Wisconsin

Wis. Stat. § 134/98

Wis. Stat. § 134/98

Wyoming

Wyo. Stat. §§ 40-12-501 to -502

 

District of Columbia

D.C. Code §§ 28-3851 et seq.

D.C. Code §§ 28-3851 et seq.

Guam

9 GCA §§ 48-10 et seq. 9 GCA §§ 48-10 et seq.

Puerto Rico

10 LRPA §§ 4051 et seq.

10 LRPA §§ 4051 et seq.

Virgin Islands

 V.I. Code tit. 14 § 2209

V.I. Code tit. 14 § 2208

*Some states have additional statutory cybersecurity reporting requirements wherein a cybersecurity incident, as defined, must be reported to a central state agency.

This chart does not include state statutes requiring notification of breaches of student data. 

Additional Resources