ShareAndGoShareAndGo

Data breach notification

Alaska data breach notification law

Alaska's breach duties are part of the Alaska Personal Information Protection Act, codified at AS 45.48.010 to 45.48.090.

One feature stands out: the duty reaches personal information in any form, so paper records are inside it as well as computer systems.

Information the Act protects

Personal information here means a first name or first initial and last name together with a listed element, where the information is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired. The listed elements are:

  • the individual's Social Security number;
  • a driver's license number or state identification card number;
  • an account, credit or debit card number, with the personal code where one is needed to access the account;
  • passwords, personal identification numbers or other access codes for financial accounts.

Telling Alaska residents

A covered person who owns or licenses personal information on a state resident, and who discovers or is notified of a breach, must disclose the breach to each state resident whose information was subject to it. Alaska gives no day count. The words in the statute are "in the most expeditious time possible and without unreasonable delay."

Because there is no fixed number of days, the pace of the investigation becomes the practical measure. A business that can show what it learned and when is better placed to explain why its timing was expeditious.

The no-harm route and the Attorney General

Disclosure to individuals is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines there is not a reasonable likelihood that harm to the affected consumers has resulted or will result. Choosing that route also means keeping the written determination for five years.

Put plainly, the Attorney General in Alaska hears about a breach when a business relies on the no-harm exception, and that notice comes before the decision not to tell individuals. Separately, when more than 1,000 residents are notified, the nationwide consumer reporting agencies must also be told under AS 45.48.040.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Each data room has a watermark setting that is on by default, so whatever a reader views in the room shows their address and the viewing date. Groups see only the folders assigned to them, which keeps the list of people who could have opened a file short. Recipients confirm their email with a six-digit code and need no account. The chained log exports to CSV, giving an investigator a dated list of who opened which document inside the room.

Questions people ask about Alaska

Does Alaska's rule cover paper files?
Yes. The duty applies to personal information in any form, not only computerized data.
How quickly must residents be told?
In the most expeditious time possible and without unreasonable delay. The statute sets no number of days.
Can a business decide not to tell residents?
Only after an appropriate investigation and written notification to the attorney general, and only if it determines there is not a reasonable likelihood of harm.
Is encrypted data exempt?
Encrypted or redacted information is outside the definition, unless the encryption key has been accessed or acquired.

Source check

Checked against Alaska's published law on November 2, 2026. This is general information, not legal advice.

More on breach notice

Breach notification laws by state

Every state and territory we have checked.

ShareAndGo vs DataRooms.com

Two approaches to data room records.

ShareAndGo

Back to ShareAndGo.