Data breach notification

US data breach notification laws, one page per state and territory

Breach notification rules differ from one jurisdiction to the next: who must be told about a data breach, what counts as personal information, and how quickly notice has to go out.

Each page below summarizes one jurisdiction from the official text its legislature or attorney general publishes, with the sources listed on the page. Where we could not find an official text on a government website, we say so rather than summarize from an unofficial copy.

Choose a jurisdiction

Alabama data breach notification law

Ala. Code §§ 8-38-1 to 8-38-12 (notice to individuals § 8-38-5; to the Attorney General § 8-38-6)

Alaska data breach notification law

AS 45.48.010 to 45.48.090

Arizona data breach notification law

A.R.S. § 18-552 (definitions § 18-551)

Arkansas data breach notification law

Ark. Code Ann. § 4-110-101 et seq. (disclosure § 4-110-105; definitions § 4-110-103), as enacted by Act 1526 of 2005 and amended by Act 1030 of 2019

California data breach notification law

Cal. Civ. Code § 1798.82

Colorado data breach notification law

C.R.S. § 6-1-716

Connecticut data breach notification law

Conn. Gen. Stat. § 36a-701b

Delaware data breach notification law

6 Del. C. §§ 12B-101 to 12B-104 (notice § 12B-102)

District of Columbia data breach notification law

D.C. Code §§ 28-3851 to 28-3853 (notice § 28-3852)

Florida data breach notification law

Fla. Stat. § 501.171

Guam data breach notification law

9 G.C.A. ch. 48 (§§ 48.10-48.80)

Hawaii data breach notification law

Haw. Rev. Stat. ch. 487N (notice § 487N-2; definitions § 487N-1)

Idaho data breach notification law

Idaho Code § 28-51-105 (definitions § 28-51-104)

Illinois data breach notification law

815 ILCS 530 (notice § 530/10)

Indiana data breach notification law

Ind. Code art. 24-4.9

Iowa data breach notification law

Iowa Code § 715C.2 (definitions § 715C.1)

Kansas data breach notification law

K.S.A. 50-7a01 and 50-7a02

Kentucky data breach notification law

KRS 365.732

Louisiana data breach notification law

La. R.S. 51:3074 (definitions 51:3073)

Maine data breach notification law

10 M.R.S. § 1348 (definitions § 1347)

Maryland data breach notification law

Md. Code, Com. Law § 14-3504 (definitions § 14-3501)

Massachusetts data breach notification law

Mass. Gen. Laws ch. 93H, § 3 (definitions § 1)

Michigan data breach notification law

MCL 445.72 (definitions MCL 445.63)

Minnesota data breach notification law

Minn. Stat. § 325E.61

Mississippi data breach notification law

Laws 2010, H.B. 583, § 1 (commonly cited as Miss. Code Ann. § 75-24-29)

Missouri data breach notification law

Mo. Rev. Stat. § 407.1500

Montana data breach notification law

Mont. Code Ann. § 30-14-1704

Nebraska data breach notification law

Neb. Rev. Stat. §§ 87-801 to 87-808

Nevada data breach notification law

Nev. Rev. Stat. §§ 603A.040, 603A.220

New Hampshire data breach notification law

N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21

New Jersey data breach notification law

N.J. Stat. Ann. §§ 56:8-161, 56:8-163

New Mexico data breach notification law

N.M. Stat. Ann. ch. 57, art. 12C (enacted by 2017 HB 15)

New York data breach notification law

N.Y. Gen. Bus. Law § 899-aa

North Carolina data breach notification law

N.C. Gen. Stat. §§ 75-61, 75-65

North Dakota data breach notification law

N.D. Cent. Code ch. 51-30

Ohio data breach notification law

Ohio Rev. Code § 1349.19

Oklahoma data breach notification law

Okla. Stat. tit. 24, §§ 161-166

Oregon data breach notification law

Or. Rev. Stat. §§ 646A.600 to 646A.628 (notice at § 646A.604)

Pennsylvania data breach notification law

Act of Dec. 22, 2005, P.L. 474, No. 94, as amended (73 P.S. § 2301 et seq.)

Puerto Rico data breach notification law

10 L.P.R.A. §§ 4051-4055

Rhode Island data breach notification law

R.I. Gen. Laws ch. 11-49.3 (notice at § 11-49.3-4)

South Carolina data breach notification law

S.C. Code Ann. § 39-1-90

South Dakota data breach notification law

S.D. Codified Laws §§ 22-40-19 to 22-40-26

Tennessee data breach notification law

Tenn. Code Ann. § 47-18-2107

Texas data breach notification law

Tex. Bus. & Com. Code § 521.053

Utah data breach notification law

Utah Code §§ 13-44-102, 13-44-202

Vermont data breach notification law

9 V.S.A. §§ 2430, 2435

Virginia data breach notification law

Va. Code Ann. § 18.2-186.6

Washington data breach notification law

Wash. Rev. Code §§ 19.255.005, 19.255.010

West Virginia data breach notification law

W. Va. Code §§ 46A-2A-101 to 46A-2A-105

Wisconsin data breach notification law

Wis. Stat. § 134.98

Wyoming data breach notification law

Wyo. Stat. Ann. §§ 40-12-501, 40-12-502

Not summarized here

Georgia

Georgia's official code is published online by a commercial publisher (LexisNexis) for the state, not on a Georgia government website. We check these pages against text a government publishes, so we haven't summarized Georgia's law here. An attorney can tell you what it requires.

US Virgin Islands

The US Virgin Islands' official code is published by a commercial publisher (LexisNexis), with no official text on a government website. We check these pages against text a government publishes, so we haven't summarized it here. An attorney can tell you what it requires.

How these pages were checked

Each page was checked against the jurisdiction's published law on November 2, 2026, and lists the official sources it rests on. A few pages rest on session laws or older official compilations, and those pages say so. This is general information, not legal advice.