Data breach notification
Arkansas's Personal Information Protection Act is cited as Ark. Code Ann. § 4-110-101 et seq., with disclosure in § 4-110-105 and definitions in § 4-110-103.
This page was checked against the session laws that enacted and amended it, Act 1526 of 2005 and Act 1030 of 2019, as published on the Arkansas Legislature's site.
The current compiled code is published only through a commercial host, so the official acts were read instead. Any amendment made after Act 1030 of 2019 is not reflected here, and a reader relying on this page for a live matter should confirm the current text.
The Act covers a first name or first initial and last name together with one or more listed data elements, when either the name or the data element is not encrypted or redacted.
The 2019 Act describes biometric data broadly: fingerprints, faceprint, retina or iris scan, hand geometry, voiceprint, DNA, or other unique biological characteristics used for authentication.
Disclosure to affected individuals is to be made "in the most expedient time and manner possible and without unreasonable delay." There is no fixed number of days for that step.
Act 1030 of 2019 added a notice to the Attorney General when a breach affects the personal information of more than one thousand (1,000) individuals. That notice is due at the same time the breach is disclosed to an affected individual or within forty-five (45) days after determining there is a reasonable likelihood of harm, whichever comes first.
Section 4-110-105(d) says notification is not required if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm. Act 1030 attaches a record to that decision: the written determination is kept for five years and produced to the Attorney General on request within 30 days.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark is on by default and can be set room by room. Recipients confirm their email with a six-digit code and need no account, and NDA acceptance is available on Professional and Business. Groups see only their own folders, so the set of people who could have opened any one file is known before anything goes wrong. Together that gives a business a dated trail of who opened a shared file inside the room, which it can export as CSV and keep beside its own written findings.
Checked against Arkansas's Act 1526 of 2005 and Act 1030 of 2019 on November 2, 2026. This is general information, not legal advice.
