Expert Commentary

Breach Notification Laws—State Attorney General or Regulator Notice

This article provides a brief overview of the laws providing for notification of a state attorney general or regulator about a breach in addition to notifying affected individuals.


Cyber and Privacy Risk and Insurance
February 2019

Fifty states, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, have breach notification laws. The breach notification laws require notification of affected individuals of a breach.  

Thirty-one state breach notification laws—Alabama, Arizona, California, Colorado, Connecticut, Delaware, Florida, Hawaii, Illinois, Indiana, Iowa, Louisiana, Maine, Maryland, Massachusetts, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oregon, Rhode Island, South Carolina, South Dakota, Vermont, Virginia, and Washington—plus the Puerto Rico breach notification law require notification of a breach to a state attorney general or regulator in addition to notifying the affected individuals.1

The following states' breach notification laws require notification to a state attorney general or regulator in addition to notifying the affected individuals.

  • North Dakota, more than 250 individuals
  • Oregon and South Dakota, more than 250 residents
  • Florida, 500 or more individuals
  • Colorado, 500 or more residents
  • California, Delaware, Iowa, Rhode Island, or Washington, more than 500 residents
  • Alabama, Arizona, and Hawaii, more than 1,000 individuals
  • Missouri, more than 1,000 consumers
  • New Mexico and South Carolina, more than 1,000 residents

The Connecticut, Illinois, Indiana, Louisiana, Maine, Maryland, Massachusetts, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Vermont, and Virginia breach notification laws, plus the Puerto Rico breach notification law, require notification of a breach to a state attorney general or regulator regardless of the number of affected individuals.


1The Code of Ala. § 8-38-1 et seq.; Ariz. Rev. Stat. § 18-551 et seq.; Cal. Civ. Code § 1798.82; Colo. Rev. Stat. § 6-1-716; Conn. Gen. Stat. § 36a–701b; Del. Code tit. 6, § 12B-101 et seq.; Fla. Stat. § 501.171; Haw. Rev. Stat. § 487N–2; Illinois 815 ILCS 530/50; Ind. Code § 24-4.9 et seq.; Iowa Code § 715C.2; La. Rev. Stat. § 51:3074 and La. Admin. Code tit. 16, pt. III, § 701; Me. Rev. Stat. Ann. tit. 10, § 1348; MD Code, Com. Law § 14–3504; Mass. Gen. Laws ch. 93H; Missouri Rev. Stat. § 407.1500; MCA § 30–14–1704; Neb. Rev. Stat. § 87–801 et seq.; N.H. Rev. Stat. § 359–C:20; N.J. Stat. Ann. § 56:8–163; N.M.S.A. § 57-12C-1 et seq.; N.Y. Gen. Bus. Law § 899–aa; N.C. Gen. Stat. § 75–65; N.D. Cent. Code § 51-30-01 et seq.; Or. Rev. Stat. § 646A.604; R.I. Gen. Laws § 11–49.3–4; S.C. Code § 39–1–90; S.D. Cod. Laws § 22-40-20 et seq.; Vt. Stat. Ann. tit. 9, § 2435; Va. Code Ann. § 18.2–186.6; RCW § 19.255.010; and 10 L.P.R.A. § 4052.


Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.

Like This Article?

IRMI Update

Dive into thought-provoking industry commentary every other week, including links to free articles from industry experts. Discover practical risk management tips, insight on important case law and be the first to receive important news regarding IRMI products and events.

Learn More



User ID: Subscriber Status:Free