Data breach notification

Louisiana data breach notification law

Louisiana's rules are in the Database Security Breach Notification Law, La. R.S. 51:3074, with definitions in 51:3073.

The 60-day limit

Notice to residents shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach. Sixty days is the ceiling, not the target. The clock runs from discovery, so the date a business first learns of the breach is worth recording carefully.

If notice is delayed past that period, the business provides the attorney general the reasons for the delay in writing within the sixty day notification period.

Definition of personal information

The definition pairs the first name or first initial and last name of a Louisiana resident with any of: a Social Security number; a driver's license or state ID number; an account, credit or debit card number with any required code or password; a passport number; or biometric data.

It applies when the name or the data element is not encrypted or redacted.

When notice is not required

Notification is not required if, after a reasonable investigation, the business determines that there is no reasonable likelihood of harm to Louisiana residents. That written determination must be sent to the Attorney General on request.

What this page does not cover

The statute's own text has been read for this page. A separate Attorney General notice duty is set by an Attorney General rule rather than by R.S. 51:3074, and that rule was not read from an official source, so this page does not describe it. Ask an attorney about it before relying on this summary.

Where ShareAndGo fits

A business looking into an incident needs to know who saw a file without rebuilding the story from email threads.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Each room carries the watermark setting, on by default. The log is chained and exports as CSV, and it also records uploads, invitations and changes. Recipients confirm their email with a six-digit code and need no account.

Louisiana questions

What is the outer deadline for residents?
Not later than sixty days from the discovery of the breach, and sooner where the most expedient time possible allows.
What if a business needs more time?
It gives the attorney general the reasons for the delay in writing within the sixty day period.
Are passports and biometrics covered?
Yes. Passport number and biometric data are both listed data elements.
Can a business decide notice is unnecessary?
Yes, if a reasonable investigation shows no reasonable likelihood of harm to Louisiana residents, and the written determination goes to the Attorney General on request.

Checked on

Checked against Louisiana's published law on November 2, 2026. This is general information, not legal advice.