This article provides a brief overview of the laws providing for notification of a state attorney general or regulator about a breach in addition to notifying affected individuals.
Fifty states, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, have breach notification laws. The breach notification laws require notification of affected individuals of a breach.
Thirty-one state breach notification laws—Alabama, Arizona, California, Colorado, Connecticut, Delaware, Florida, Hawaii, Illinois, Indiana, Iowa, Louisiana, Maine, Maryland, Massachusetts, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oregon, Rhode Island, South Carolina, South Dakota, Vermont, Virginia, and Washington—plus the Puerto Rico breach notification law require notification of a breach to a state attorney general or regulator in addition to notifying the affected individuals.1
The following states' breach notification laws require notification to a state attorney general or regulator in addition to notifying the affected individuals.
North Dakota, more than 250 individuals
Oregon and South Dakota, more than 250 residents
Florida, 500 or more individuals
Colorado, 500 or more residents
California, Delaware, Iowa, Rhode Island, or Washington, more than 500 residents
Alabama, Arizona, and Hawaii, more than 1,000 individuals
Missouri, more than 1,000 consumers
New Mexico and South Carolina, more than 1,000 residents
The Connecticut, Illinois, Indiana, Louisiana, Maine, Maryland, Massachusetts, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Vermont, and Virginia breach notification laws, plus the Puerto Rico breach notification law, require notification of a breach to a state attorney general or regulator regardless of the number of affected individuals.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
1 The Code of Ala. § 8-38-1 et seq.; Ariz. Rev. Stat. § 18-551 et seq.; Cal. Civ. Code § 1798.82; Colo. Rev. Stat. § 6-1-716; Conn. Gen. Stat. § 36a–701b; Del. Code tit. 6, § 12B-101 et seq.; Fla. Stat. § 501.171; Haw. Rev. Stat. § 487N–2; Illinois 815 ILCS 530/50; Ind. Code § 24-4.9 et seq.; Iowa Code § 715C.2; La. Rev. Stat. § 51:3074 and La. Admin. Code tit. 16, pt. III, § 701; Me. Rev. Stat. Ann. tit. 10, § 1348; MD Code, Com. Law § 14–3504; Mass. Gen. Laws ch. 93H; Missouri Rev. Stat. § 407.1500; MCA § 30–14–1704; Neb. Rev. Stat. § 87–801 et seq.; N.H. Rev. Stat. § 359–C:20; N.J. Stat. Ann. § 56:8–163; N.M.S.A. § 57-12C-1 et seq.; N.Y. Gen. Bus. Law § 899–aa; N.C. Gen. Stat. § 75–65; N.D. Cent. Code § 51-30-01 et seq.; Or. Rev. Stat. § 646A.604; R.I. Gen. Laws § 11–49.3–4; S.C. Code § 39–1–90; S.D. Cod. Laws § 22-40-20 et seq.; Vt. Stat. Ann. tit. 9, § 2435; Va. Code Ann. § 18.2–186.6; RCW § 19.255.010; and 10 L.P.R.A. § 4052.