Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Arkansas |
|---|---|
| Statute citation | Ark. Code Ann. §§ 4-110-101 to 4-110-108 (Personal Information Protection Act) (amended 2019) |
| Individual notice timing | Most expedient time possible and without unreasonable delay Arkansas requires businesses and |
| Attorney general notice | Yes Arkansas requires Attorney General notification when a breach affects the personal information of |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Arkansas 'breach of the security of the system' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business. It does not include the good faith acquisition of personal information by an employee or agent of the person or business for the legitimate purposes of the person or business if the personal information is not otherwise used or subject to further unauthorized disclosure. 1 |