The Status of Data Breach Notification Laws in the United States
May 16, 2014
Summary: “In today's environment, it's not a matter of if a data breach will occur, but when it will occur, and how well you respond. Do everything you can to prevent data breaches, but also fully plan out how you will respond if you are breached. Today's media and business environment demands that two-pronged approach,” advises Brian Lapidus, Chief Operating Officer of Kroll Fraud Solutions. The warning is clear: companies wanting to protect their money and their credit need to have a data breach response plan in place before it becomes necessary. As they say, “a good offense is a good defense.”
There is no one-size-fits-all approach to prepare your business for this eventuality, as evidenced by the disarray of state notification laws. Therefore, you should tailor your response plan to the unique laws of your state and the unique assets of your business.
To find your state's data breach notification law, as well as its most recent amendment and effective date, consult the following chart:
| State | Statute | Amended or Effective Date |
| Alabama | No data breach notification law |
|
| Alaska | Alaska Stat. § 45.48.010 et seq. | July 1, 2009 |
| Arizona | Ariz. Rev. Stat. § 44-7501 | December 31, 2006 |
| Arkansas | Ark. Code § 4-110-101 et seq. | August 12, 2005 |
| California | Cal. Civ. Code §§ 1798.29, 1798.80, et seq. | January 1, 2014 |
| Colorado | Colo. Rev. Stat. § 6-1-716 | September 1, 2006 |
| Connecticut | Conn. Gen Stat. § 36a-701b | October 1, 2012 |
| Delaware | Del. Code tit. 6, § 12B-101 et seq. | June 28, 2005 |
| District of Columbia | D.C. Code § 28- 3851 et seq. | July 1, 2007 |
| Florida | Fla. Stat. § 817.5681 | July 1, 2005 |
| Georgia | Ga. Code §§ 10-1-910, -911, -912; § 46-5-214 | May 5, 2005 |
| Guam | 9 GCA § 48-10 et seq. | March 13, 2009 |
| Hawaii | Haw. Rev. Stat. § 487N-1 et seq. | July 1, 2008 |
| Idaho | Idaho Stat. §§ 28-51-104 to -107 | July 1, 2006 |
| Illinois | 815 ILCS §§ 530/1 to 530/25 | January 1, 2012 |
| Indiana | Ind. Code §§ 4-1-11 et seq., 24-4.9 et seq. | June 30, 2006 |
| Iowa | Iowa Code §§ 715C.1, 715C.2 | July 1, 2008 |
| Kansas | Kan. Stat. § 50-7a01 et seq. | January 1, 2007 |
| Kentucky | No data breach notification law |
|
| Louisiana | La. Rev. Stat. § 51:3071 et seq. | January 1, 2006 |
| Maine | Me. Rev. Stat. tit. 10 § 1347 et seq. | May 19, 2009 |
| Maryland | Md. Code Com. Law §§ 14-3501 et seq. | January 1, 2008 |
| Massachusetts | Mass. Gen. Laws § 93H-1 et seq. | October 31, 2007 |
| Michigan | Mich. Comp. Laws §§ 445.63, 445.72 | April 1, 2011 |
| Minnesota | Minn. Stat. §§ 325E.61, 325E.64 | January 1, 2006 |
| Mississippi | Miss. Code § 75-24-29 | July 1, 2011 |
| Missouri | Mo. Rev. Stat. § 407.1500 | August 28, 2009 |
| Montana | Mont. Code § 2-6-504, 30-14-1701 et seq. | March 1, 2006 |
| Nebraska | Nev. Rev. Stat. §§ 603A.010 et seq., 242.183 | January 1, 2006 |
| Nevada | Nev. Rev. Stat. §§ 603A.010 et seq., 242.183 | January 1, 2006 |
| New Hampshire | N.H. Rev. Stat. §§ 359-C:19, et seq. | January 1, 2007 |
| New Jersey | N.J. Stat. § 56:8-163 | January 1, 2006 |
| New Mexico | No data breach notification law |
|
| New York | N.Y. Gen. Bus. Law § 899-aa | March 28, 2013 |
| North Carolina | N.C. Gen. Stat §§ 75-61, 75-65 | December 1, 2005 |
| North Dakota | N.D. Cent. Code § 51-30-01 et seq. | June 1, 2005 |
| Ohio | Ohio Rev. Code §§ 1347.12, et seq. | March 30, 2007 |
| Oklahoma | Okla. Stat. §§ 74-3113.1, 24-161 to -166 | November 1, 2008 |
| Oregon | Oregon Rev. Stat. § 646A.600 et seq. | October 1, 2007 |
| Pennsylvania | 73 Pa. Stat. § 2301 et seq. | June 20, 2006 |
| Puerto Rico | 10 Laws of Puerto Rico § 4051 et seq. | January 5, 2006 |
| Rhode Island | R.I. Gen. Laws § 11-49.2-1 et seq. | March 1, 2006 |
| South Carolina | S.C. Code § 39-1-90, 2013 H.B. 3248 | April 23, 2013 |
| South Dakota | No data breach notification law |
|
| Tennessee | Tenn. Code § 47-18-2107 | July 1, 2005 |
| Texas | Tex. Bus. & Com. Code § 521.002, et seq. | September 1, 2009 |
| Utah | Utah Code § 13-44-101 et seq. | March 12, 2009 |
| Vermont | Vt. Stat. tit. 9 §§ 2430, 2435 | May 8, 2012 |
| Virgin Islands | V.I. Code tit. 14, § 2208 | October 17, 2005 |
| Virginia | Va. Code §§ 18.2-186.6, 32.1-127.1:05 | July 1, 2008 |
| Washington | Wash. Rev. Code §§ 19.255.010, 42.56.590 | July 24, 2005 |
| West Virginia | W.V. Code §§ 46A-2A-101 et seq. | June 7, 2008 |
| Wisconsin | Wis. Stat. § 134.98 | March 28, 2008 |
| Wyoming | Wyo. Stat. § 40-12-501 et seq. | July 1, 2007 |
This premium content is locked for FC&S Coverage Interpretation Subscribers
Enjoy unlimited access to the trusted solution for successful interpretation and analyses of complex insurance policies.
- Quality content from industry experts with over 60 years insurance experience, combined
- Customizable alerts of changes in relevant policies and trends
- Search and navigate Q&As to find answers to your specific questions
- Filter by article, discussion, analysis and more to find the exact information you’re looking for
- Continually updated to bring you the latest reports, trending topics, and coverage analysis
Already have an account? Sign In Now
For enterprise-wide or corporate access, please contact our Sales Department at 1-800-543-0874 or email [email protected]