Laws Governing Data Security and Privacy by State

ALASKA STAT. §§ 45.48.010, – .090

Upon Discovery of Breach, Is Notice to State Regulators Required?
To Attorney General Only

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
Yes, if more than 1,000 state residents are notified

Number of Days Required for Notification
To affected individuals – In the most expeditious time possible and without unreasonable delay
To credit agencies – without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Both

Encryption Safe Harbor?
Yes

Fines and/or Penalties
$500 for each state resident. Total penalty may not exceed $50,000.

Does Statute Provide for a Private Cause of Action?
Yes

Upon Discovery of Breach, Is Notice to State Regulators Required?
No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
No

Number of Days Required for Notification
To affected individuals –  in the most expedient manner possible and without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Electronic Data

Encryption Safe Harbor?
Yes

Fines and/or Penalties
Not more than $10,000 per breach

Does Statute Provide for a Private Cause of Action?
No

Upon Discovery of Breach, Is Notice to State Regulators Required?
No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
No

Number of Days Required for Notification
To affected individuals – in the most expedient time and manner possible and without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Electronic Data

Encryption Safe Harbor?
Yes

Fines and/or Penalties
Not more than $10,000 per violation

Does Statute Provide for a Private Cause of Action?
No

Upon Discovery of Breach, Is Notice to State Regulators Required?
To Attorney General Only, if notice to more than 500 residents is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
No

Number of Days Required for Notification
To affected individuals –  in the most expedient time possible and without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
Yes

Does Statute Cover Electronic Data, Paper Records, or Both?
Both

Encryption Safe Harbor?
Yes

Fines and/or Penalties
$500 per violation or $3,000 for a willful, intentional or reckless violation

Does Statute Provide for a Private Cause of Action?
Yes

Upon Discovery of Breach, Is Notice to State Regulators Required?
No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
Yes, if notice to more than 1,000 Colorado residents is required

Number of Days Required for Notification
To affected individuals – in the most expedient time possible and without unreasonable delay
To credit agencies – without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Both

Encryption Safe Harbor?
Yes

Fines and/or Penalties
None

Does Statute Provide for a Private Cause of Action?
No

Upon Discovery of Breach, Is Notice to State Regulators Required?
To Attorney General Only

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
No

Number of Days Required for Notification
To affected individuals –without unreasonable delay but not later than 90 days after the discovery of such breach, unless a shorter time is required under federal law
To Attorney General – not later than the time when notice is provided to the resident

Law Enforcement Delay?
Yes, otherwise notice must be provided no later than 90 days after discovery of breach

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Electronic Data

Encryption Safe Harbor?
Yes

Fines and/or Penalties
Not more than $5,000 per violation

Does Statute Provide for a Private Cause of Action?
No

Upon Discovery of Breach, Is Notice to State Regulators Required?
Yes, if notice to more than 500 residents is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
No

Number of Days Required for Notification
To affected individuals – without unreasonable delay but no later than 60 days after a determination of breach

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Electronic Data

Encryption Safe Harbor?
Yes

Fines and/or Penalties
None

Does Statute Provide for a Private Cause of Action?
Yes

Upon Discovery of Breach, Is Notice to State Regulators Required?
No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification
To affected individuals – the most expedient time possible and without unreasonable delay
To credit agencies – without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
Yes

Does Statute Cover Electronic Data, Paper Records, or Both?
Electronic Data

Encryption Safe Harbor?
No

Fines and/or Penalties
Not more than $100 per violation (each failure to provide a notification shall constitute a separate violation)

Does Statute Provide for a Private Cause of Action?
Yes

Upon Discovery of Breach, Is Notice to State Regulators Required?
To the Department of Legal Affairs, if 500 residents are affected by breach or To the Agency for State Technology, if covered entity is a state agency

Upon Discovery of Breach, Is Notice to Credit Agencies Required?
Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification
To affected individuals and Attorney General – as expeditiously as practicable and without unreasonable delay, but no later than 30 days after the determination of a breach or reason to believe a breach occurred
To credit agencies – without unreasonable delay

Law Enforcement Delay?
Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?
No

Does Statute Cover Electronic Data, Paper Records, or Both?
Both

Encryption Safe Harbor?
Yes

Fines and/or Penalties
$1,000 per day for the first 30 days following any violation and $50,000 for each subsequent 30-day period for up to 180 days
If violation continues for more than 180 days, the penalty is an amount not to exceed $500,000

Does Statute Provide for a Private Cause of Action?
No

O.C.G.A. §§ 10-1-910 – 915, 46-5-214

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 10,000 residents is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data and Telephone Records

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$0 for a data breach; $100 for a failure of a credit reporting agency to implement a consumer-requested security freeze

Does Statute Provide for a Private Cause of Action?

Yes

GUAM CODE ANN. tit. 9, §§ 48.10 – .80

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per breach of the security system

Does Statute Provide for a Private Cause of Action?

No

HAW. REV. STAT. §§ 487N-1, – 7

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Office of Consumer Protection, if notice to more than 1,000 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals, the Office of Consumer Protection, and credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $2,500 per violation

Does Statute Provide for a Private Cause of Action?

Yes

IDAHO CODE ANN. §§ 28-51-104 – 107

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General, if covered entity is a public agency

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To Attorney General – within 24 hours of awareness of breach

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $25,000 per violation

Does Statute Provide for a Private Cause of Action?

No

815 ILL. COMP. STAT. 530/1 – /50

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General, if covered entity is a state agency and notice to more than 250 residents is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if covered entity is a state agency and notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To Attorney General – within 45 days of the state agency’s discovery of the security breach or when the state agency provides notice to affected individuals

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$100 per individual (not to exceed $50,000)

Does Statute Provide for a Private Cause of Action?

Yes

IND. CODE §§ 4-1-11-1 – 10, 24-4.9-1-1 – 5-1

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General Only (No, if covered entity is a state agency)

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals, Attorney General, credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No (Yes, if covered entity is a state agency)

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per violation

Does Statute Provide for a Private Cause of Action?

No

IOWA CODE §§ 715C.1, – .2

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General Only, if notice to more than 500 Iowa residents is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expeditious manner possible and without unreasonable delay

To Attorney General – within 5 days of providing notice to consumer

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $40,000 per violation

Does Statute Provide for a Private Cause of Action?

No

KAN. STAT. ANN. §§ 50-7A01 – 02

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

No

KY. REV. STAT. ANN. §§ 365.720 – .734, 61.931-.934

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General and if breach involves a public agency to the commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General if the breach involves a public agency

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – In the most expedient time possible and without unreasonable delay

To credit agencies – without unreasonable delay

To Attorney General and regulators – as soon as possible, but within seventy-two (72) hours of determination or notification of the security breach

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

Yes

LA. REV. STAT. ANN. §§ 51:3071 – 3077, 40:1173.1-.6, LA. ADMIN. CODE tit. 16, pt. III, § 701

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General Only

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To Attorney General – within ten (10) days of distribution of notice to Louisiana citizens

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No (Yes, if covered entity is the Department of Health)

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $5,000 per violation (each day notice is not received by the Attorney General shall be deemed a separate violation)

Does Statute Provide for a Private Cause of Action?

Yes

ME. REV. STAT. ANN. tit. 10, §§ 1346 – 1350-B

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the appropriate state regulators within the Department of Professional and Financial Regulators or if the person is not regulated to the Attorney General

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – as expediently as possible and without unreasonable delay

To credit agencies – without unreasonable delay

To regulators or Attorney General – when notice of a breach of the security system is required

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $500 per violation, up to a maximum of $2,500 for each day the person is in violation of this chapter.

Does Statute Provide for a Private Cause of Action?

No

MD. CODE ANN. COM. LAW §§ 14-3501 – 3508, MD. CODE ANN. STATE GOV’T §§ 10-1301 – 1308

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General and if breach involves a public agency to the Department of Informational Technology

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – as soon as practicable after the business conducts the required investigation

To credit agencies – without unreasonable delay

To Attorney General and/or Department of Information Technology – prior to giving notification to consumer

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$1,000 for first violation, a subsequent repeat violation results in fine of not more than $5,000 for each subsequent violation

Does Statute Provide for a Private Cause of Action?

Yes

MASS. GEN. LAWS ch. 93H, §§ 1 – 6

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General and the director of consumer affairs and business regulation

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes

Number of Days Required for Notification

To affected individuals, credit agencies, Attorney General and director of consumer affairs and business regulation – as soon as practicable and without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $5,000 for each violation, or $10,000 for violating an injunction entered pursuant to an enforcement action

Does Statute Provide for a Private Cause of Action?

No

2017 MI H.B. 6405-06

Upon Discovery of Breach, Is Notice to State Regulators Required?

To department of technology, management, and budget if number of residents to notify exceeds 750.

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – as expeditiously as possible and without unreasonable delay. A covered entity that uses a credit card payment processor or gateway in the conduct of its business should provide notice within 45 days. An covered entity that does not should provide notice within 75 days.

To the department of technology, management, and budget – after notifying affected individuals and without unreasonable delay. A covered entity should provide notice within 45 days from the determination

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $2,000 for each violation, or not more than $5,000 per day for each consecutive day the covered entity fails to take reasonable action to comply. A person’s aggregate liability for civil fines for multiple violations related to the same breach shall not exceed $250,000.

Does Statute Provide for a Private Cause of Action?

No, the Attorney General has exclusive authority to bring an action to recover a civil fine.

MINN. STAT. §§ 13.055, 325E.61, 325E.64

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 500 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies – within 48 hours

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not to exceed $25,000

Does Statute Provide for a Private Cause of Action?

Yes

MISS. CODE ANN. § 75-24-29

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $10,000 per violation

Does Statute Provide for a Private Cause of Action?

No

MO. REV. STAT. § 407.1500
2019 MO. H.B. 35 Proposed Legislation

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General, if notice to more than 1,000 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – immediately following discovery of the breach.
Proposed legislation requires notice to consumers within 30 days of the discovery.
To Attorney General – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per breach

Does Statute Provide for a Private Cause of Action?

No

MONT. CODE ANN. §§ 2-6-1503, 30-14-1701 – 1736, 33-19-321

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General and if breach involves a state agency to the State’s Chief Information Officer at the Department of Administration

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

If notice is provided to any resident and the notice suggests, indicates or implies that the resident may obtain a copy of their consumer report, entity must coordinate with consumer report agency as to timing, content and distribution of notice

Number of Days Required for Notification

To affected individuals – without unreasonable delay

To credit agencies – the business shall coordinate with agency as to timing of notice to individual. Coordination may not unreasonably delay notice to affected individuals

To Attorney General and State’s Chief Information Officer – simultaneously

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No (Yes, if covered entity is a licensee or insurance-support organization)

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $10,000 per violation

Does Statute Provide for a Private Cause of Action?

No

NEB. REV. STAT. §§ 87-801 – 807

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General Only

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – as soon as possible and without unreasonable delay

To Attorney General– not later than the time when notice is provided to the Nebraska resident

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

No

NEV. REV. STAT. §§ 603A.010 – .920, 242.183

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

No, but Attorney General may bring an action to obtain a temporary or permanent injunction against violations of the breach notification statute.

Further, a data collector that provides the requisite breach notification may commence an action for damages against a person that unlawfully obtained information or benefited from a breach.

N.H. REV. STAT. ANN. §§ 359-C:19 – :21, 189:66

Upon Discovery of Breach, Is Notice to State Regulators Required?

To regulator which has primary regulatory authority over such trade or commerce if engaged in trade or commerce that is subject to jurisdiction of bank commissioner, director of securities regulation, insurance commission, public utilities commission. All others to the Attorney General

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – as soon as possible

To credit agencies – without unreasonable delay

To Attorney General and/or regulators – prior to giving notice to individuals

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No (Yes, if covered entity is the Department of Education)

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $10,000 per violation, and no less than double and no more than treble damages in private actions upon finding of willful violation

Does Statute Provide for a Private Cause of Action?

Yes

N.J. STAT. ANN. §§ 56:8-161 – 166

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Division of State Police in the Department of Law and Public Safety

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies – without unreasonable delay

To police – in advance of the disclosure to the customer

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Yes (Under New Jersey Consumer Protection Act)

Does Statute Provide for a Private Cause of Action?

Yes (Under New Jersey Consumer Protection Act; N.J. STAT. ANN. § 56:8-2.11)

H.B. 15 (signed by governor on April 6, 2017, law is effective as of June 16, 2017)

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General, if notice to more than 1,000 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals, credit agencies and Attorney General – in the most expedient time possible, but not later than 45 calendar days following discovery

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Penalty of the greater of $25,000 or in the case of failed notification $10 per failed notification up to a maximum of $150,000

Does Statute Provide for a Private Cause of Action?

Yes

N.Y. GEN. BUS. LAW § 899-AA, N.Y. STATE TECH. LAW §§ 201 – 208

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General and the Department of State and the Division of State Police

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 5,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

To credit agencies , Attorney General and Department of State and State Police – without delaying notice to affected New York residents

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $5,000 or up to $10 per instance of failed notification up to a maximum of $150,000, for knowing or reckless violations

Does Statute Provide for a Private Cause of Action?

Yes

N.C. GEN. STAT. §§ 75-60 – 66

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General Only

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals, credit agencies and Attorney General- without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $5,000 per violation

Does Statute Provide for a Private Cause of Action?

Yes, if an individual has been injured

N.D. CENT. CODE §§ 51-30-01 – 07

Upon Discovery of Breach, Is Notice to State Regulators Required?

To Attorney General, if notice to more than 250 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals and Attorney General – in the most expedient time possible and without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $5,000 per violation

Does Statute Provide for a Private Cause of Action?

Yes

OHIO REV. CODE ANN. §§ 1347.12, 1349.19 – .192

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible but no later than 45 days

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

After 60 days of non-compliance, $1,000 per day for first the 60 days, and $5,000 per day from day 61. After 90 days of non-compliance $1,000 per day for first the 60 days, $5,000 per day for days 61 through 90, and $10,000 per day from day 91.

Does Statute Provide for a Private Cause of Action?

No

OKLA. STAT. tit. 74, § 3113.1, tit. 24, §§ 161 – 166

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes, if a state agency identifies a breach; No, if an individual or business identifies a breach

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per breach or series of breaches of a similar nature that are discovered in a single investigation

Does Statute Provide for a Private Cause of Action?

No

OR. REV. STAT. §§ 646A.600 – .628

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General, if notice to more than 250 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals and the Attorney General – in the most expeditious manner possible, without unreasonable delay but not later than 45 days

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$1,000 per (each violation is a separate offense and, in the case of a continuing violation, each day’s continuance is a separate violation) with a maximum penalty not to exceed $500,000

Does Statute Provide for a Private Cause of Action?

Yes (implicitly authorized)

73 PA. STAT. ANN. §§ 2301 – 2329

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals and credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$1,000 per willful violation, $3,000 per willful violation if consumer is 60 or older

Does Statute Provide for a Private Cause of Action?

No

P.R. LAWS ANN. tit. 10, §§ 4051 – 4055

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Department of Consumer Affairs (or to the Citizen’s Advocate Office if the covered entity is a government agency or public corporation)

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – As expeditiously as possible
To the Department of Consumer Affairs – within a non-extendable term of ten days

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Between $500 and $5,000 for each violation

Does Statute Provide for a Private Cause of Action?

Yes

R.I. GEN. LAWS §§ 11-49.3-1 – .3-6

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General, if notice to more than 500 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 500 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible, but no later than 45 calendar days

To the Attorney General and credit agencies – without delaying notice to affected Rhode Island residents

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$100 per record for reckless violations; $200 per record for knowing and willful violations

Does Statute Provide for a Private Cause of Action?

No

S.C. CODE ANN. §§ 39-1-90, 1-11-490

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Consumer Protection Division of the Department of Consumer Affairs if notice to more than 1,000 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay
To the Consumer Protection Division of the Department of Consumer Affairs and credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

$1,000 per resident for knowing and willful violations

Does Statute Provide for a Private Cause of Action?

Yes

2018 S.D. S.B. 62 (Signed by the Governor 3/21/18, effective July 1, 2018)

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General if notice to more than 250 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes

Number of Days Required for Notification

To affected individuals – not later than 60 days from the discovery or notification of the breach

To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $10,000 per day per violation

Does Statute Provide for a Private Cause of Action?

No

TENN. CODE ANN. §§ 47-18-2101 – 2111, 8-4-119

Upon Discovery of Breach, Is Notice to State Regulators Required?

No (Yes, to the Office of the Comptroller of the Treasury, if covered entity is a state agency)

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – immediately, but no later than 45 days
To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

The greater of $10,000; $5,000 per day for each day that a person’s identity has been assumed, or 10 times the amount obtained or attempted to be obtained by the person using the identity theft

Does Statute Provide for a Private Cause of Action?

Yes

TEX. BUS. & COM. CODE ANN. §§ 521.001 – .152, TEX. EDUC. CODE ANN. § 37.007(B)(5)

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 10,000 individuals is required

Number of Days Required for Notification

To affected individuals – as quickly as possible
To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

At least $2,000 but no more than $50,000 for each violation, plus, if a person fails to take reasonable action to comply with the individual notice requirement, not more than $100 for each individual to whom notification is due for each consecutive day that person fails to comply, not exceeding $250,000 for all individuals to whom notification is due after a single breach

Does Statute Provide for a Private Cause of Action?

Yes, to declare an individual a victim of identity theft

UTAH CODE ANN. §§ 13-44-101 – 301, 53E-9-304

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expedient time possible without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No (Yes, if student’s data is breached, by the covered education entity)

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $2,500 for a violation or series of violations concerning a specific consumer, and no greater than $100,000 in the aggregate for related violations concerning more than one consumer

Does Statute Provide for a Private Cause of Action?

No

VT. STAT. ANN. tit. 9, §§ 2430 – 2445

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General (or to the Department of Financial Regulation if the covered entity is regulated by that department)

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay, but not later than 45 days
To the Attorney General – within 14 business days
To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $10,000 for each violation

Does Statute Provide for a Private Cause of Action?

No

VA. CODE ANN. §§ 18.2-186.6, 32.1-127.1:05

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General (and to the Commissioner of Health if medical information was acquired)

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals, the Attorney General, and credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per breach of the security of the system or a series of breaches of a similar nature that are discovered in a single investigation

Does Statute Provide for a Private Cause of Action?

Yes

V.I. CODE ANN. tit. 14, §§ 2200 – 2212

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

Yes

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

Yes

WASH REV. CODE §§ 19.255.010 – .020, 42.56.590

Upon Discovery of Breach, Is Notice to State Regulators Required?

To the Attorney General, if notice to more than 500 individuals is required

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals and the Attorney General – in the most expedient time possible and without unreasonable delay, no more than 45 calendar days

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $2,000 for each violation

Does Statute Provide for a Private Cause of Action?

Yes

W. VA. CODE §§ 46A-2A-101 – 105

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals and credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $150,000 per breach of security of the system or series of breaches of a similar nature that are discovered in a single investigation for repeated and willful violations

Does Statute Provide for a Private Cause of Action?

No

WIS. STAT. §§ 134.97 – .98

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

Yes, if notice to more than 1,000 individuals is required

Number of Days Required for Notification

To affected individuals – within a reasonable time, not to exceed 45 days
To credit agencies – without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Both

Encryption Safe Harbor?

Yes

Fines and/or Penalties

Not more than $1,000 per violation

Does Statute Provide for a Private Cause of Action?

Yes

WYO. STAT. ANN. §§ 40-12-501 – 509

Upon Discovery of Breach, Is Notice to State Regulators Required?

No

Upon Discovery of Breach, Is Notice to Credit Agencies Required?

No

Number of Days Required for Notification

To affected individuals – in the most expedient time possible and without unreasonable delay

Law Enforcement Delay?

Yes

Is Breach Notification to Affected Individuals Required if there is a Low Risk of Harm?

No

Does Statute Cover Electronic Data, Paper Records, or Both?

Electronic Data

Encryption Safe Harbor?

Yes

Fines and/or Penalties

None

Does Statute Provide for a Private Cause of Action?

Yes, to declare an individual a victim of identity theft