Skip to content
Network USA

FL · Breach notification statute

Florida data breach notification law

A summary of the Florida breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Fla. Stat. § 501.171 (Security of Confidential Personal Information) (amended 2023)

Last amended
2023 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

30 days Florida requires covered entities (businesses) to notify affected individuals no later than 30 days

Attorney general notice

Yes Florida requires notification to the Department of Legal Affairs (Attorney General) when the breach

What counts as a breach

In Florida 'breach of security' or 'breach' means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of the covered entity does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use. 1

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Florida

473 reports to HHS OCR affecting 54,112,976 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Florida.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Independent Living Systems, LLCBusiness Associate4,226,508Sep 2, 2022Hacking/IT IncidentArchive (closed)
Reventics, LLCBusiness Associate4,212,823Feb 10, 2023Hacking/IT IncidentArchive (closed)
20/20 Eye Care Network, IncBusiness Associate4,142,440May 24, 2021Hacking/IT IncidentArchive (closed)
Florida Healthy Kids CorporationHealth Plan3,500,000Jan 29, 2021Hacking/IT IncidentArchive (closed)
NationsBenefits Holdings, LLCBusiness Associate3,099,502Apr 13, 2023Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Florida businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Florida timing rule as: "30 days Florida requires covered entities (businesses) to notify affected individuals no later than 30 days". (Source: PRC 2026 survey extract.)

Does Florida require notice to the attorney general?

The PRC 2026 extract notes: "Yes Florida requires notification to the Department of Legal Affairs (Attorney General) when the breach". (Source: PRC 2026 survey extract.)

Does the Florida law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Florida breach law.

Does the Florida law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Florida breach law.

Does the Florida law cover paper records?

No. The PRC 2026 survey records the Florida law as covering computerised data only, not paper records.

Is there a private right of action in Florida?

No. The PRC 2026 survey does not record a private right of action under the Florida breach law.

Is credit monitoring required in Florida?

No. The PRC 2026 survey does not record a credit monitoring requirement in Florida.

How does the Florida law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Florida statute, and see our HIPAA vs state breach notification laws guide.

Sources