Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Illinois |
|---|---|
| Statute citation | Not extracted in our PRC 2026 summary; check the statute. |
| Individual notice timing | notify in the 'most expedient time possible and without unreasonable delay.' No specific numeric |
| Attorney general notice | Yes Illinois requires AG notification from data collectors (500+ residents) and State agencies (250+ |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Illinois 'breach of the security of the system data' or 'breach' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector.1 |