Data breach notification
Maine's breach rules are the Notice of Risk to Personal Data Act, 10 M.R.S. § 1348, with definitions in § 1347.
Notice must be given as expediently as possible and without unreasonable delay. If there is no delay for a law enforcement investigation, the notices must be made no more than 30 days after the business becomes aware of a breach of security and identifies its scope.
That second trigger matters: the 30 days are counted from awareness plus scope, not from the first alert alone.
Whenever resident notice is required, the business also notifies the appropriate state regulators within the Department of Professional and Financial Regulation, or, if it is not regulated by that department, the Attorney General.
So a business regulated by that department reports there, and a business it does not regulate reports to the Attorney General.
| Element type | Covered when |
|---|---|
| Name plus Social Security number | The name or data elements are not encrypted or redacted |
| Name plus driver's license or state ID number | Same condition |
| Name plus account, credit or debit card number | The number is usable without additional codes |
| Name plus account passwords, PINs or other access codes | Same condition |
| Any of those elements without a name | Enough to let someone fraudulently assume or attempt to assume the person's identity |
Businesses other than information brokers give notice only if misuse of the personal information has occurred or it is reasonably possible that misuse will occur. Information brokers notify on acquisition.
For ordinary businesses, then, the question is whether misuse is reasonably possible, not only whether it has already happened.
Scoping an incident is faster with a reliable record of who opened what.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
In each data room the watermark setting starts switched on. Groups only ever see their own folders, and recipients confirm their email with a six-digit code without creating an account, so the people in the log are confirmed addresses. The chained log exports as CSV.
Checked against Maine's published law on November 2, 2026. This is general information, not legal advice.
