Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Maine |
|---|---|
| Statute citation | Me. Rev. Stat. tit. 10, §§ 1346-1350-B (Notice of Risk to Personal Data Act) (amended 2019) |
| Individual notice timing | 30 days Maine requires businesses and other persons to notify affected individuals within 30 days of |
| Attorney general notice | Yes Maine requires notification to state regulators or the Attorney General for all breaches requiring |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Maine 'breach of the security of the system' or 'security breach' means unauthorized acquisition, release or use of an individual's computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person, excluding good faith acquisition, release or use by an employee or agent on behalf of a person if the personal information is not used for or subject to further unauthorized disclosure. |