Data breach notification
Michigan's breach notice section is MCL 445.72, part of the Identity Theft Protection Act, with definitions in MCL 445.63.
So encryption helps in Michigan only while the key stays out of the wrong hands.
Notice is not required if the business determines that the security breach has not caused and is not likely to cause substantial loss or injury to, or result in identity theft with respect to, one or more Michigan residents.
The determination is the business's to make, and the wording covers both past and likely future harm.
Any notice required by the section must be provided without unreasonable delay. Michigan sets no fixed number of days. No regulator notice appears in MCL 445.72.
Without a state office in the loop, the residents themselves are the audience, and the harm exception above decides whether letters go out at all. Businesses that rely on the exception should be able to explain why loss, injury and identity theft were all unlikely.
Personal information means the first name or first initial and last name linked to a Social Security number; a driver license or state personal identification card number; or a demand deposit or other financial account number, or a credit or debit card number, with any required code or password.
It is worth checking which records in a given incident actually match Michigan's list.
Understanding an incident starts with knowing which files were opened, and by whom.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Watermarking is set room by room and is on by default. Recipients confirm their email with a six-digit code and need no account, groups see only their folders, and the chained log exports as CSV for anyone reviewing the timeline.
Checked against Michigan's published law on November 2, 2026. This is general information, not legal advice.
