ShareAndGoShareAndGo

Data breach notification

Florida data breach notification law

Florida's rule is Fla. Stat. § 501.171, Security of confidential personal information, and it sets a 30 day deadline for individuals and a separate notice to the Department of Legal Affairs.

At a glance

TopicFla. Stat. § 501.171
IndividualsAs expeditiously as practicable and without unreasonable delay, but no later than 30 days after the determination of a breach or reason to believe a breach occurred
Department of Legal Affairs (Attorney General)Notice of any breach of security affecting 500 or more individuals in Florida
Department timingWithin 30 days, with 15 more days for good cause
Harm exceptionAvailable after an appropriate investigation and consultation with law enforcement
Encrypted dataEncrypted, secured or otherwise unusable information is outside the definition

The 30 days for individuals can move only through a delay authorized under paragraph (b) or a waiver under paragraph (c) of the section.

Personal information under § 501.171

The definition begins with an individual's first name or first initial and last name in combination with listed data elements for that individual. Those elements are a Social Security number; a driver's license, ID card, passport, military ID or similar government ID number; a financial account or card number with any required code or password; medical history, condition, treatment or diagnosis; a health insurance policy or subscriber number; biometric data; and geolocation information.

The geolocation item is broad in its own words: "Any information regarding an individual's geolocation." A username or email address with a password or security question and answer for an online account is covered as well.

The no-harm determination in Florida

Notice to individuals is not required if, after an appropriate investigation and consultation with relevant federal, state or local law enforcement agencies, the covered entity reasonably determines the breach has not and will not likely result in identity theft or any other financial harm.

That decision has paperwork attached: the determination is put in writing, kept for five years, and a copy goes to the Department within 30 days. In practice the written record of the investigation becomes the evidence for the decision.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is set per room and is on from the start. Readers prove their email with a six-digit code, and none of them needs an account. Each group sees only its own folders, so the people who could have seen a file are known in advance. The chained log of views, uploads, downloads, invitations and changes exports as CSV for anyone writing up what happened in a room.

Florida FAQ

Who is the regulator in Florida?
The Department of Legal Affairs, which is the Attorney General's department.
At what size does the Department hear about a breach?
Any breach of security affecting 500 or more individuals in Florida.
Is geolocation personal information?
Yes, when combined with a name. The section lists any information regarding an individual's geolocation.

Check date

Checked against Florida's published law on November 2, 2026. This is general information, not legal advice.

Keep going

Breach notification laws by state

Breach notice for every jurisdiction.

ShareAndGo vs DataRooms.com

Data room comparison.

ShareAndGo

ShareAndGo home.