ShareAndGoShareAndGo

Data breach notification

Pennsylvania data breach notification law

Pennsylvania's Breach of Personal Information Notification Act is Act 94 of 2005, as amended, found at 73 P.S. § 2301 and following.

We read the General Assembly's consolidated text, which carries amendments through Act 33 of 2024.

Loss or injury

A breach under the act is one that causes, or that the entity reasonably believes has caused or will cause, loss or injury to any resident of the Commonwealth. When that is the case, notice goes to any resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.

Both halves matter: the data must have been accessed and acquired, and the incident must carry the prospect of loss or injury.

Covered information

Personal information is a name linked to listed elements when the data elements are not encrypted or redacted.

  • Social Security number.
  • Driver's license or state identification card number.
  • Account or card number with any required code or password.
  • Medical information held by a state agency or a state contractor.
  • Health insurance information.
  • A user name or email address with a password or security question and answer that would permit access to an online account.

Timing and the Attorney General

For a business, the notice shall be made without unreasonable delay. If notice must be given to more than 500 affected individuals in the Commonwealth, notice shall be made concurrently to the Office of Attorney General.

Public bodies run on a different clock: state agencies, counties, public schools and municipalities have separate deadlines of seven business days. Private businesses do not share that fixed count. A company that contracts with a state agency should read the medical information element with care, since it is tied to information held by an agency or its contractor.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarks are a room-by-room setting, on unless switched off. Readers confirm their email with a six-digit code and need no account, and groups see only their folders. With the chained log exported as CSV, a Pennsylvania business can show which of its files kept in ShareAndGo were opened, by whom and when, without rebuilding that from email threads.

Pennsylvania questions

Is there a fixed deadline for businesses?
No number of days; the standard is without unreasonable delay.
When must the Attorney General hear?
Concurrently with resident notice, when more than 500 Pennsylvanians must be notified.
Are online account logins covered?
Yes, a user name or email address with a password or security question and answer.
Do public bodies have different rules?
Yes. State agencies, counties, public schools and municipalities have seven-business-day deadlines.

Source

Checked against Pennsylvania's published law on November 2, 2026. This is general information, not legal advice.

Continue

Breach notification laws by state

Every jurisdiction's breach rules.

Compare data rooms

Compare data rooms.

ShareAndGo home

ShareAndGo home.