Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Florida |
|---|---|
| Statute citation | Fla. Stat. § 501.171 (Security of Confidential Personal Information) (amended 2023) |
| Individual notice timing | 30 days Florida requires covered entities (businesses) to notify affected individuals no later than 30 days |
| Attorney general notice | Yes Florida requires notification to the Department of Legal Affairs (Attorney General) when the breach |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Florida 'breach of security' or 'breach' means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of the covered entity does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use. 1 |