IRMI Online Talk With Us
Home Articles Expert Commentary Breach Notification Laws—State Attorney General or Regulator Notice
Cyber and Privacy Risk and Insurance

Breach Notification Laws—State Attorney General or Regulator Notice

Melissa Krasnow | February 28, 2019

On This Page
Attorney general documents

This article provides a brief overview of the laws providing for notification of a state attorney general or regulator about a breach in addition to notifying affected individuals.

Fifty states, plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, have breach notification laws. The breach notification laws require notification of affected individuals of a breach.  

Thirty-one state breach notification laws—Alabama, Arizona, California, Colorado, Connecticut, Delaware, Florida, Hawaii, Illinois, Indiana, Iowa, Louisiana, Maine, Maryland, Massachusetts, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oregon, Rhode Island, South Carolina, South Dakota, Vermont, Virginia, and Washington—plus the Puerto Rico breach notification law require notification of a breach to a state attorney general or regulator in addition to notifying the affected individuals. 1

The following states' breach notification laws require notification to a state attorney general or regulator in addition to notifying the affected individuals.

  • North Dakota, more than 250 individuals
  • Oregon and South Dakota, more than 250 residents
  • Florida, 500 or more individuals
  • Colorado, 500 or more residents
  • California, Delaware, Iowa, Rhode Island, or Washington, more than 500 residents
  • Alabama, Arizona, and Hawaii, more than 1,000 individuals
  • Missouri, more than 1,000 consumers
  • New Mexico and South Carolina, more than 1,000 residents

The Connecticut, Illinois, Indiana, Louisiana, Maine, Maryland, Massachusetts, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Vermont, and Virginia breach notification laws, plus the Puerto Rico breach notification law, require notification of a breach to a state attorney general or regulator regardless of the number of affected individuals.

Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.

Footnotes

1 The Code of Ala. § 8-38-1 et seq.; Ariz. Rev. Stat. § 18-551 et seq.; Cal. Civ. Code § 1798.82; Colo. Rev. Stat. § 6-1-716; Conn. Gen. Stat. § 36a–701b; Del. Code tit. 6, § 12B-101 et seq.; Fla. Stat. § 501.171; Haw. Rev. Stat. § 487N–2; Illinois 815 ILCS 530/50; Ind. Code § 24-4.9 et seq.; Iowa Code § 715C.2; La. Rev. Stat. § 51:3074 and La. Admin. Code tit. 16, pt. III, § 701; Me. Rev. Stat. Ann. tit. 10, § 1348; MD Code, Com. Law § 14–3504; Mass. Gen. Laws ch. 93H; Missouri Rev. Stat. § 407.1500; MCA § 30–14–1704; Neb. Rev. Stat. § 87–801 et seq.; N.H. Rev. Stat. § 359–C:20; N.J. Stat. Ann. § 56:8–163; N.M.S.A. § 57-12C-1 et seq.; N.Y. Gen. Bus. Law § 899–aa; N.C. Gen. Stat. § 75–65; N.D. Cent. Code § 51-30-01 et seq.; Or. Rev. Stat. § 646A.604; R.I. Gen. Laws § 11–49.3–4; S.C. Code § 39–1–90; S.D. Cod. Laws § 22-40-20 et seq.; Vt. Stat. Ann. tit. 9, § 2435; Va. Code Ann. § 18.2–186.6; RCW § 19.255.010; and 10 L.P.R.A. § 4052.
IRMI Online