ShareAndGoShareAndGo

Data breach notification

Illinois data breach notification law

Illinois sets its breach rules in the Personal Information Protection Act, 815 ILCS 530, with the notice duty in section 530/10.

What counts as personal information in Illinois

The Act starts with a person's first name or first initial and last name, paired with at least one more element: a Social Security number, a driver's license or state ID number, an account or card number together with any code or password it needs, medical information, health insurance information, or unique biometric data.

A second, standalone category covers a user name or email address combined with a password or a security question and answer that would permit access to an online account. Encryption or redaction keeps data out of scope only while the keys stay safe: if the keys to unencrypt or unredact were acquired without authorization through the breach, the data is covered again.

Deadlines and the Attorney General at a glance

PointWhat 815 ILCS 530/10 says
Notice to residentsIn the most expedient time possible and without unreasonable delay
Attorney General noticeRequired when a single breach calls for notice to more than 500 Illinois residents
Attorney General timingIn no event later than when consumers are notified
Risk-of-harm exceptionNone appears in the notice duty
Encrypted dataOutside the definition unless the keys were acquired

Illinois gives no fixed number of days. The resident notice is due in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system.

Two Illinois details worth knowing

Illinois does not let a business skip the resident notice because it judges the risk of harm to be low; no such exception appears in the notice duty. The resident notice also must not state how many Illinois residents were affected.

The 500-resident count matters for the Attorney General notice, and that notice can fall due no later than the consumer notice itself. So a business working toward its letters to residents is also, in effect, working toward its Attorney General deadline.

Where ShareAndGo fits

When something goes wrong in a data room, the first question is usually who opened which file, and when.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is a per-room setting, on by default, so every page a reader sees names that reader. The log is chained, each entry linked to the one before it, and it exports as CSV for your own review or your advisers. Recipients confirm their email with a six-digit code and need no account, so each entry ties back to a confirmed address rather than a shared link.

Illinois questions

Does Illinois set a number of days for notice?
No. The Act asks for notice in the most expedient time possible and without unreasonable delay, and gives no day count.
When does the Illinois Attorney General need to hear about a breach?
When a single breach requires notice to more than 500 Illinois residents, and in no event later than when consumers are notified.
Are online account logins covered?
Yes. A user name or email address with a password or security question and answer that would permit access to an online account is personal information under the Act.
Is biometric data covered?
Yes. Unique biometric data is one of the listed elements when it sits alongside a name.

About this page

Checked against Illinois's published law on November 2, 2026. This is general information, not legal advice.

More on breach notice

Breach notification laws by state

Every state and territory on one page.

ShareAndGo vs DataRooms.com

How two data rooms handle activity records.

ShareAndGo

Back to the ShareAndGo home page.