PRC 2026 survey extract
State data breach notification laws: 50 states and DC
Every US state and the District of Columbia has a breach notification statute. This table compares the fields extracted from the Privacy Rights Clearinghouse 2026 survey. Blank fields show as "Not extracted".
51 of 51 shown
| Individual notice timing | AG notice | |||||||
|---|---|---|---|---|---|---|---|---|
| Alabama | Ala. Code §§ 8-38-1 to 8-38-12 (Data Breach Notification Act of 2018) (amended 2018) | 45 days Alabama requires covered entities (including businesses) to notify affected individuals within 45 | Yes Alabama requires written notice to the Attorney General within 45 days when more than 1,000 | No | Yes | No | No | No |
| Alaska | Alaska Stat. §§ 45.48.010 to 45.48.090 (Personal Information Protection Act) (amended 2008) | without unreasonable delay Alaska requires businesses to notify | notifications on a public website? | No | No | Yes | Yes | No |
| Arizona | Ariz. Rev. Stat. §§ 18-551 to 18-552 (Data Security Breaches (Network Security)) (amended 2022) | 45 days Arizona requires businesses and persons to notify affected individuals within 45 days after | Yes Arizona requires notification to both the Attorney General and the Director of the Arizona | Yes | Yes | No | No | No |
| Arkansas | Ark. Code Ann. §§ 4-110-101 to 4-110-108 (Personal Information Protection Act) (amended 2019) | Most expedient time possible and without unreasonable delay Arkansas requires businesses and | Yes Arkansas requires Attorney General notification when a breach affects the personal information of | Yes | Yes | No | Yes | No |
| California | This state has 2 separate breach notification statutes; Private Sector: Cal. Civ. Code § 1798.82 (Customer Records - Personal Information... | Without unreasonable delay California requires government agencies to notify in the most expedient | Yes California requires AG notification when a breach affects more than 500 California residents, with | Yes | Yes | No | Yes | Yes |
| Colorado | Colo. Rev. Stat. § 6-1-716 (Colorado Consumer Protection Act - Notification of Security Breach) (amended 2018) | 30 days Colorado requires businesses/covered entities to notify affected individuals in the most expedient | Yes Colorado requires AG notification within 30 days when a breach affects 500 or more Colorado | Yes | Yes | No | No | No |
| Connecticut | Conn. Gen. Stat. § 36a-701b (Banking Law of Connecticut - Breach of Security re Computerized Data) (amended 2023) | 60 days Connecticut requires businesses/persons to notify affected residents without unreasonable delay | Yes Connecticut requires AG notification no later than the time notice is provided to affected residents for | Yes | Yes | No | Yes | Yes |
| Delaware | Del. Code tit. 6, ch. 12B (Computer Security Breaches) (amended 2017) | 60 days Delaware requires businesses/persons to notify affected individuals without unreasonable delay | Yes Delaware requires Attorney General notification when the breach affects more than 500 Delaware | Yes | Yes | No | No | Yes |
| District of Columbia | D.C. Code §§ 28-3851 to 28-3853 (Consumer Security Breach Notification) (amended 2020) | Not applicable - government exempt DC explicitly excludes the District of Columbia government and its | Yes DC requires AG notification when a breach affects 50 or more District residents, no later than when | Yes | Yes | No | Yes | Yes |
| Florida | Fla. Stat. § 501.171 (Security of Confidential Personal Information) (amended 2023) | 30 days Florida requires covered entities (businesses) to notify affected individuals no later than 30 days | Yes Florida requires notification to the Department of Legal Affairs (Attorney General) when the breach | Yes | Yes | No | No | No |
| Georgia | O.C.G.A. §§ 10-1-910 to 10-1-915 (Georgia Personal Identity Protection Act) (amended 2024) | Most expedient time possible and without unreasonable delay Georgia requires information brokers | No Georgia does not require notification to the Attorney General or any state agency; notification | No | No | No | No | No |
| Hawaii | Not extracted | Without unreasonable delay Hawaii requires businesses to notify affected persons without unreasonable | Yes Hawaii requires notification to the State of Hawaii's Office of Consumer Protection when a business | No | No | Yes | Yes | No |
| Idaho | Idaho Code §§ 28-51-104 to 28-51-107 (Commercial Transactions - Identity Theft) (amended | Most expedient time possible without unreasonable delay Idaho requires businesses to notify affected | notifications on a public website? | No | No | No | No | No |
| Illinois | Not extracted | notify in the 'most expedient time possible and without unreasonable delay.' No specific numeric | Yes Illinois requires AG notification from data collectors (500+ residents) and State agencies (250+ | Yes | Yes | No | Yes | No |
| Indiana | Not extracted | Not applicable - state agencies exempt Indiana explicitly exempts state agencies from the breach | Yes Indiana requires notification to the Attorney General for all breaches that require disclosure to | No | No | Yes | No | No |
| Iowa | Iowa Code Ch. 715C (Personal Information Security Breach Protection) (amended 2018) | without unreasonable delay Iowa requires businesses to notify in the | Yes Iowa requires AG notification (Consumer Protection Division) within 5 business days after consumer | Yes | No | Yes | No | No |
| Kansas | Not extracted | Most expedient time possible without unreasonable delay Kansas requires businesses to notify affected | No Kansas does not require notification to the Attorney General or any state agency as part of breach | No | No | No | No | No |
| Kentucky | This state has 2 separate breach notification statutes; Private Sector: KRS § 365.732 (Trade Practices - Security Breach Notification)... | notify affected individuals in the most expedient time possible without unreasonable delay, consistent | Yes Kentucky requires government agencies to notify the Attorney General (and other officials) within 72 | No | No | No | No | No |
| Louisiana | La. R.S. § 51:3074 (Database Security Breach Notification Law) (amended 2018) | 60 days Louisiana requires businesses/persons to notify affected individuals in the most expedient time | No Louisiana does not require proactive notification to the Attorney General for breaches; AG notification | Yes | No | No | Yes | No |
| Maine | Me. Rev. Stat. tit. 10, §§ 1346-1350-B (Notice of Risk to Personal Data Act) (amended 2019) | 30 days Maine requires businesses and other persons to notify affected individuals within 30 days of | Yes Maine requires notification to state regulators or the Attorney General for all breaches requiring | No | No | No | No | No |
| Maryland | Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 (Personal Information Protection) (amended | not later than 45 days after discovering or being notified of a breach. 33 | Yes Maryland requires AG notification prior to notifying affected individuals, with no threshold, all | Yes | Yes | No | Yes | No |
| Massachusetts | Mass. Gen. Laws ch. 93H, §§ 1-6 (General Laws Chapter 93H - Security Breaches) (amended 2019) | notify affected individuals 'as soon as practicable and without unreasonable delay' with no specific day | Yes Massachusetts requires notification to both the Attorney General and the Director of Consumer | No | No | Yes | Yes | Yes |
| Michigan | Mich. Comp. Laws §§ 445.61-445.79d (Identity Theft Protection Act) (Identity Theft Protection Act) (amended 2018) | Without unreasonable delay Michigan requires businesses and persons to notify affected individuals | No Michigan does not require notification to the Attorney General or any state agency for security | No | No | No | No | No |
| Minnesota | This state has 2 separate breach notification statutes; Private Sector: Minn. Stat. § 325E.61 (Trade Practices - Data Breach Notification)... | Most expedient time possible and without unreasonable delay Minnesota requires businesses and | No Minnesota does not require breach notification to the Attorney General or any state agency. 44 | No | No | No | Yes | No |
| Mississippi | Miss. Code Ann. § 75-24-29 (Consumer Protection - Security Breach Notification) (amended | Not applicable - government agencies not covered Mississippi's breach notification law applies only to | No Mississippi does not require notification to the Attorney General or any state agency. 44 | No | No | No | No | No |
| Missouri | Mo. Rev. Stat. § 407.1500 (Merchandising Practices - Security Breach Notification) (amended | Without unreasonable delay Missouri requires businesses and persons to notify affected consumers | Yes Missouri requires Attorney General notification without unreasonable delay when a breach requires | No | Yes | No | No | No |
| Montana | This state has 3 separate breach notification statutes; Private Sector: Mont. Code Ann. §§ 30-14-1701, 30-14-1702, 30-14-1704 (Unfair Trade | Without unreasonable delay Montana requires businesses to notify affected individuals without | Yes Montana requires AG notification simultaneously with individual notification for all breaches across all | No | Yes | No | Yes | No |
| Nebraska | Neb. Rev. Stat. §§ 87-801 to 87-808 (Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006) (amended 2018) | notify affected residents as soon as possible and without unreasonable delay following completion of | Yes Nebraska requires Attorney General notification concurrent with notification to affected residents for | Yes | No | No | No | No |
| Nevada | Nev. Rev. Stat. §§ 603A.010 to 603A.290 (Security and Privacy of Personal Information) (amended | Most expedient time possible and without unreasonable delay Nevada requires businesses (data | No Nevada's breach notification statute does not require notification to the Attorney General or any state | No | Yes | No | Yes | No |
| New Hampshire | N.H. Rev. Stat. Ann. §§ 359-C:19 to 359-C:21 (New Hampshire Right to Privacy Act (Notice of Security Breach Subdivision)) (amended 2006) | Not extracted | Yes New Hampshire requires notification to the primary regulatory authority or Attorney General's office | No | No | No | Yes | No |
| New Jersey | N.J. Stat. Ann. §§ 56:8-161 to 56:8-166 (Identity Theft Prevention Act (Data Breach Notification Provisions)) (amended 2019) | Most expedient time possible and without unreasonable delay New Jersey requires businesses to notify | Yes New Jersey requires notification to the Division of State Police before disclosing to customers for all | No | No | No | Yes | No |
| New Mexico | N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (Data Breach Notification Act) (amended 2017) | Not extracted | Yes New Mexico requires Attorney General notification when a breach affects more than 1,000 residents, | Yes | No | No | No | No |
| New York | N.Y. Gen. Bus. Law §§ 899-aa to 899-bb (Notification of Unauthorized Acquisition of Private Information; Data Security Protections (SHIELD... | 30 days New York requires businesses and persons to notify affected individuals in the most expedient | Yes New York requires notification to the Attorney General, Department of State, Division of State Police, | Yes | Yes | No | No | No |
| North Carolina | N.C. Gen. Stat. §§ 75-60 to 75-66 (Identity Theft Protection Act) (amended 2009) | North Carolina | Yes North Carolina requires notification to the Consumer Protection Division of the Attorney General's | Yes | No | Yes | Yes | No |
| North Dakota | N.D. Cent. Code §§ 51-30-01 to 51-30-07 (Notice of Security Breach for Personal Information) (amended 2015) | most expedient time possible and without unreasonable delay North Dakota requires persons | Yes North Dakota requires notification to the Attorney General by mail or email for breaches affecting | No | Yes | No | Yes | No |
| Ohio | This state has 2 separate breach notification statutes; Private Sector: Ohio Rev. Code § 1349.19 (Consumer Protection - Private Disclosure... | 45 days Ohio requires businesses and persons to notify affected individuals in the most expedient time | No Ohio does not require entities to notify the Attorney General or any state agency of data breaches; the | No | No | No | No | No |
| Oklahoma | This state has 2 separate breach notification statutes; Private Sector: 24 Okla. Stat. §§ 161-166 (Security Breach Notification Act)... | Without unreasonable delay Oklahoma requires individuals and businesses to notify affected individuals | notifications on a public website? | No | No | No | No | No |
| Oregon | Or. Rev. Stat. §§ 646A.600-646A.628 (Oregon Consumer Information Protection Act) (amended | 45 days Oregon requires covered entities (including businesses) to notify affected consumers within 45 | Yes Oregon requires Attorney General notification when a breach affects more than 250 consumers; | Yes | Yes | No | Yes | No |
| Pennsylvania | 73 P.S. §§ 2301-2330 (Breach of Personal Information Notification Act) (amended 2024) | notify affected individuals within 7 business days following determination of a breach. 34 | Yes Pennsylvania requires AG notification when more than 500 individuals in the Commonwealth are | No | Yes | No | No | Yes |
| Rhode Island | R.I. Gen. Laws §§ 11-49.3-1 to 11-49.3-7 (Rhode Island Identity Theft Protection Act of 2015) (amended 2023) | 45-day | Yes Rhode Island requires notification to the Attorney General when more than 500 Rhode Island | No | Yes | Yes | No | Not extracted |
| South Carolina | S.C. Code Ann. § 39-1-90 (Trade and Commerce - Breach of Security; Notifications) (amended | notify in the most expedient time possible and without unreasonable delay, with no specific numeric | Yes South Carolina requires notification to the Consumer Protection Division of the Department of | No | No | Yes | Yes | No |
| South Dakota | S.D. Codified Laws §§ 22-40-19 to 22-40-26 (Identity Crimes - Breach of System Security) (amended 2018) | 60 days South Dakota requires information holders (including businesses/persons) to notify affected | Yes South Dakota requires notification to the Attorney General for breaches affecting more than 250 | Yes | Yes | No | Yes | No |
| Tennessee | Tenn. Code Ann. §§ 47-18-2101 to 47-18-2111 (Tennessee Identity Theft Deterrence Act of 1999) (amended 2025) | 45 days Tennessee requires businesses and persons to notify affected individuals no later than 45 days | No Tennessee does not require notification to the Attorney General or any state agency as part of its | No | No | No | Yes | No |
| Texas | Tex. Bus. & Com. Code §§ 521.001-.152 (Identity Theft Enforcement and Protection Act) (amended 2023) | no later than 60 days after determining the breach occurred.33 | Yes Texas requires AG notification as soon as practicable and no later than 30 days after determining the | No | Yes | No | No | No |
| Utah | Utah Code Ann. §§ 13-44-201 to 13-44-202 (Protection of Personal Information Act) (amended | notify affected individuals in the most expedient time possible without unreasonable delay, after | Yes Utah requires notification to both the Office of the Attorney General and the Utah Cyber Center when | No | No | No | No | No |
| Vermont | 9 V.S.A. §§ 2430, 2435 (Security Breach Notice Act) (amended 2020) | 45 days Vermont requires businesses to notify affected consumers in the most expedient time possible | Yes Vermont requires notification to the Attorney General (or Department of Financial Regulation for | Yes | Yes | No | Yes | No |
| Virginia | Va. Code Ann. § 18.2-186.6 (Crimes Involving Fraud - Breach of Personal Information Notification) (amended 2020) | Without unreasonable delay Virginia requires businesses and individuals to notify affected residents and | Yes Virginia requires notification to the Office of the Attorney General for all breaches (under subsection | No | No | No | Yes | No |
| Washington | This state has 2 separate breach notification statutes; Private Sector: RCW 19.255 (Personal Information: Notice of Security Breaches)... | 30 days Washington requires businesses to notify affected consumers in the most expedient time possible | Yes Washington requires Attorney General notification when breaches affect more than 500 Washington | Yes | Yes | No | Yes | No |
| West Virginia | W. Va. Code §§ 46A-2A-101 to -105 (Consumer Credit and Protection Act - Breach of Security of Consumer Information) (amended 2008) | Without unreasonable delay West Virginia requires businesses and individuals to notify affected | No West Virginia does not require notification to the Attorney General or any state agency for data | No | No | No | No | No |
| Wisconsin | Wis. Stat. § 134.98 (Trade Regulations - Notice of Unauthorized Acquisition of Personal Information) (amended 2007) | 45 days Wisconsin requires entities (including businesses) to notify affected individuals within a | No Wisconsin does not require notification to the Attorney General or any state agency for data | Yes | No | Yes | No | No |
| Wyoming | Wyo. Stat. Ann. §§ 40-12-501 to 40-12-509 (Computer Security Breach; Notice to Affected Persons) (amended 2015) | Not applicable - government agencies not covered Wyoming's notification requirements do not apply to | No Wyoming does not require notification to the Attorney General or any state agency for data | Yes | Yes | No | No | No |
Source: Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026), privacyrights.org. Excerpts are best-effort and may be truncated.
Frequently asked questions
How many states have data breach notification laws?
All 50 states and the District of Columbia have breach notification statutes summarised in the Privacy Rights Clearinghouse Data Breach Notification Laws Survey 2026, which reflects laws as of 1 January 2026. This table covers those 51 jurisdictions.