Maine data breach notification law

Who must notify and when

30 days Maine requires businesses and other persons to notify affected individuals within 30 days of

Attorney general notice

Yes Maine requires notification to state regulators or the Attorney General for all breaches requiring

What counts as a breach

In Maine 'breach of the security of the system' or 'security breach' means unauthorized acquisition, release or use of an individual's computerized data that includes personal information that compromises the security, confidentiality or integrity of personal information of the individual maintained by a person, excluding good faith acquisition, release or use by an employee or agent on behalf of a person if the personal information is not used for or subject to further unauthorized disclosure.

What counts as personal information

In Maine 'personal information' means an individual's first name, or first initial, and last name in combination with SSN, driver's license/state ID number, financial account number with access codes, or account passwords/PINs, when not encrypted or redacted; alternatively, any of these data elements alone if sufficient to permit identity fraud. Excludes third-party claims databases and publicly available information.2

Coverage and remedies

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Maine

39 reports to HHS OCR affecting 3,296,092 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Maine.

Frequently asked questions