Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Pennsylvania |
|---|---|
| Statute citation | 73 P.S. §§ 2301-2330 (Breach of Personal Information Notification Act) (amended 2024) |
| Individual notice timing | notify affected individuals within 7 business days following determination of a breach. 34 |
| Attorney general notice | Yes Pennsylvania requires AG notification when more than 500 individuals in the Commonwealth are |
| Biometric data | No |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | Yes |
| Breach definition (excerpt) | Not extracted in our PRC 2026 summary; check the statute. |