ShareAndGoShareAndGo

Data breach notification

Missouri data breach notification law

Missouri's breach notice rules are in Mo. Rev. Stat. § 407.1500.

Elements that make data personal information

The definition pairs a first name or first initial and last name with one or more of the following, where an element is not encrypted, redacted, or otherwise altered so that it is unreadable or unusable.

  • Social Security number
  • driver's license or other government ID number
  • financial account or card number with any required code or password
  • unique electronic identifier or routing code with any required code or password
  • medical information
  • health insurance information

How Missouri handles the clock

The disclosure notification shall be made without unreasonable delay. Missouri does not put a number of days on that, so the pace is judged against what a reasonable business could manage in the circumstances.

Attorney General and bureaus above 1,000

When a business notifies more than one thousand consumers at one time, it must notify the attorney general's office without unreasonable delay. The nationwide consumer reporting agencies are also notified at that size.

Below that line, the section as recorded here names no state office.

The no-risk exception, and its paper trail

Notice is not required if the business determines that a risk of identity theft or other fraud to any consumer is not reasonably likely to occur as a result of the breach. That determination must be documented in writing and kept for five years.

A determination like this is only as good as the facts behind it, which is why the underlying record of access matters.

Where ShareAndGo fits

Any finding about an incident rests on knowing exactly what happened to the files involved.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarking is a per-room setting and starts on. The chained log also records uploads, invitations and changes and exports as CSV, which gives a business a dated account to keep alongside its own findings. Recipients confirm their email with a six-digit code and need no account.

Missouri questions

Is medical information covered in Missouri?
Yes. Medical information and health insurance information are both listed elements.
When does the Attorney General get involved?
When a business notifies more than one thousand consumers at one time, it notifies the attorney general's office without unreasonable delay.
How long is a no-risk determination kept?
Five years, in writing.
Is there a fixed deadline for consumers?
No. The notice must be made without unreasonable delay.
Does encryption remove data from scope?
Yes, when elements are encrypted, redacted, or otherwise altered so that they are unreadable or unusable.

Checked on this date

Checked against Missouri's published law on November 2, 2026. This is general information, not legal advice.

Further

Breach notification laws by state

The breach notice hub for all jurisdictions.

ShareAndGo vs DataRooms.com

Data rooms compared on activity logs.

ShareAndGo

ShareAndGo home page.