Data Breach Notification Laws
Compare data breach notification requirements across all 50 states, including notification deadlines, attorney general reporting obligations, and penalties.
Click any column header to sort ascending or descending. Click again to reverse, and a third time to reset.
| State | Notification Deadline | AG Notification | Penalties |
|---|---|---|---|
| Alabama | 45 days | Yes (>500 residents) | Up to $500,000 per breach |
| Alaska | Expedient manner | No | Unfair trade practice |
| Arizona | 45 days | Yes (>1,000 residents) | Up to $500,000 |
| Arkansas | Expedient manner | No specific requirement | Civil action |
| California | Expedient manner | Yes (>500 residents) | Up to $7,500 per violation |
| Colorado | 30 days | Yes (>500 residents) | UDAP enforcement |
| Connecticut | 60 days | Yes (simultaneous) | UDAP enforcement |
| Delaware | 60 days | Yes (>500 residents) | Up to $10,000 per violation |
| Florida | 30 days | Yes (>500 residents) | Up to $500,000 per breach |
| Georgia | Expedient manner | No specific requirement | Civil action |
| Hawaii | Expedient manner | Yes | Civil action |
| Idaho | Expedient manner | Yes (>500 residents) | Up to $25,000 per breach |
| Illinois | Expedient manner | Yes | Civil action |
| Indiana | Expedient manner | Yes | Up to $150,000 per deception |
| Iowa | Expedient manner | Yes (>500 residents) | UDAP enforcement |
| Kansas | Expedient manner | No specific requirement | Civil action |
| Kentucky | Expedient manner | Yes | Civil action |
| Louisiana | 60 days | Yes | Up to $5,000 per violation |
| Maine | 30 days | Yes | Civil penalty |
| Maryland | 45 days | Yes | Up to $1,000 per violation |
| Massachusetts | Expedient manner | Yes | UDAP enforcement |
| Michigan | Expedient manner | No specific requirement | Up to $250 per failure |
| Minnesota | Expedient manner | No specific requirement | Civil action |
| Mississippi | Expedient manner | Yes | Up to $10,000 per violation |
| Missouri | Expedient manner | Yes | Up to $150,000 per breach |
| Montana | Expedient manner | No specific requirement | Civil action |
| Nebraska | Expedient manner | Yes | Civil action |
| Nevada | Expedient manner | No specific requirement | Up to $5,000 per violation |
| New Hampshire | Expedient manner | Yes | Civil penalty |
| New Jersey | Expedient manner | Yes | Up to $10,000 per violation |
| New Mexico | 45 days | Yes (>1 resident) | Up to $150,000 per breach |
| New York | Expedient manner | Yes | Up to $5,000 per violation |
| North Carolina | Expedient manner | Yes | UDAP enforcement |
| North Dakota | Expedient manner | Yes (>250 residents) | Civil action |
| Ohio | 45 days | Yes | Civil action |
| Oklahoma | Expedient manner | No specific requirement | Civil action |
| Oregon | 45 days | Yes (>250 residents) | Up to $1,000 per day |
| Pennsylvania | Expedient manner | No specific requirement | Civil action |
| Rhode Island | 45 days | Yes | Up to $100 per record |
| South Carolina | Expedient manner | Yes (>1,000 residents) | Up to $1,000 per resident |
| South Dakota | 60 days | Yes (>250 residents) | Up to $10,000 per day |
| Tennessee | 60 days | No specific requirement | UDAP enforcement |
| Texas | 60 days | Yes (>250 residents) | Up to $250,000 per breach |
| Utah | 60 days | Yes | Civil action |
| Vermont | 45 days | Yes | UDAP enforcement |
| Virginia | 60 days | Yes | Up to $150,000 per breach |
| Washington | 30 days | Yes (>500 residents) | Up to $25,000 per violation |
| West Virginia | Expedient manner | No specific requirement | Civil action |
| Wisconsin | 45 days | No specific requirement | Civil action |
| Wyoming | Expedient manner | No specific requirement | Civil action |
Data breach notification laws are frequently updated. Federal sector-specific requirements (HIPAA, GLBA) may also apply. Organizations operating in multiple states must comply with each applicable state law. Consult legal counsel for compliance guidance.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.