Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Wisconsin |
|---|---|
| Statute citation | Wis. Stat. § 134.98 (Trade Regulations - Notice of Unauthorized Acquisition of Personal Information) (amended 2007) |
| Individual notice timing | 45 days Wisconsin requires entities (including businesses) to notify affected individuals within a |
| Attorney general notice | No Wisconsin does not require notification to the Attorney General or any state agency for data |
| Biometric data | Yes |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | Yes |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Wisconsin notification is triggered when an entity knows that personal information in the entity's possession has been acquired by a person whom the entity has not authorized to acquire the personal information. Wisconsin uses "unauthorized acquisition" rather than "breach" or "security incident."1 |