Arkansas data breach notification law

Who must notify and when

Most expedient time possible and without unreasonable delay Arkansas requires businesses and

Attorney general notice

Yes Arkansas requires Attorney General notification when a breach affects the personal information of

What counts as a breach

In Arkansas 'breach of the security of the system' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person or business. It does not include the good faith acquisition of personal information by an employee or agent of the person or business for the legitimate purposes of the person or business if the personal information is not otherwise used or subject to further unauthorized disclosure. 1

What counts as personal information

In Arkansas 'personal information' means an individual's first name or first initial and his or her last name in combination with any one or more of the following data elements when either the name or the data element is not encrypted or redacted: (A) Social Security number; (B) Driver's license number or Arkansas identification card number; (C) Account number, credit card number, or debit card number in combination with any required security code, access code, or password that would permit acce

Coverage and remedies

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Arkansas

94 reports to HHS OCR affecting 2,597,059 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Arkansas.

Frequently asked questions