Data breach notification
Wisconsin's notice of unauthorized acquisition of personal information is Wis. Stat. § 134.98.
It sets a 45-day ceiling and reaches personal information in any form.
The definition starts with a last name and first name or initial, linked to an element listed in the statute.
Those elements are a Social Security number; a driver's license or state ID number; a financial account or card number, or any code or password that gives access to the account; a "deoxyribonucleic acid profile"; and "unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation."
An element counts "if the element is not publicly available information and is not encrypted, redacted, or altered in a manner that renders the element unreadable".
Publicly available information is therefore outside the definition, and so is an element that is encrypted, redacted or altered so it cannot be read.
No notice is needed where "The acquisition of personal information does not create a material risk of identity theft or fraud to the subject of the personal information."
The clock starts when the entity "learns of the acquisition", which is the moment to note in any incident file.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
In Milwaukee and Madison, labs and HR teams sharing biometric enrollment forms or account files with vendors can give each vendor a group that sees only its own folders.
The watermark is a per-room setting, on by default. Vendors verify a six-digit code sent to their email, with no account, and the chained activity log exports as CSV.
Checked against Wisconsin's published law on November 2, 2026. This is general information, not legal advice.
