Skip to content
Network USA

WI · Breach notification statute

Wisconsin data breach notification law

A summary of the Wisconsin breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Wis. Stat. § 134.98 (Trade Regulations - Notice of Unauthorized Acquisition of Personal Information) (amended 2007)

Last amended
2007 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

45 days Wisconsin requires entities (including businesses) to notify affected individuals within a

Attorney general notice

No Wisconsin does not require notification to the Attorney General or any state agency for data

What counts as a breach

In Wisconsin notification is triggered when an entity knows that personal information in the entity's possession has been acquired by a person whom the entity has not authorized to acquire the personal information. Wisconsin uses "unauthorized acquisition" rather than "breach" or "security incident."1

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationNo
Government ID numbersNot extracted
Paper recordsYes
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Wisconsin

126 reports to HHS OCR affecting 12,717,130 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Wisconsin.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
OneTouchPoint, Inc.Business Associate4,112,892Jul 27, 2022Hacking/IT IncidentArchive (closed)
Advocate Aurora HealthHealthcare Provider3,000,000Oct 14, 2022Unauthorized Access/DisclosureArchive (closed)
Forefront Dermatology, S.C.Healthcare Provider2,413,553Jul 8, 2021Hacking/IT IncidentArchive (closed)
Group Health Cooperative of South Central WisconsinHealth Plan533,809Apr 8, 2024Hacking/IT IncidentArchive (closed)
Adams CountyHealthcare Provider258,120Dec 11, 2018Unauthorized Access/DisclosureArchive (closed)

Frequently asked questions

When must Wisconsin businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Wisconsin timing rule as: "45 days Wisconsin requires entities (including businesses) to notify affected individuals within a". (Source: PRC 2026 survey extract.)

Does Wisconsin require notice to the attorney general?

The PRC 2026 extract notes: "No Wisconsin does not require notification to the Attorney General or any state agency for data". (Source: PRC 2026 survey extract.)

Does the Wisconsin law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Wisconsin breach law.

Does the Wisconsin law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Wisconsin breach law.

Does the Wisconsin law cover paper records?

Yes. The PRC 2026 survey records paper (non-computerised) records as covered in Wisconsin.

Is there a private right of action in Wisconsin?

No. The PRC 2026 survey does not record a private right of action under the Wisconsin breach law.

Is credit monitoring required in Wisconsin?

No. The PRC 2026 survey does not record a credit monitoring requirement in Wisconsin.

How does the Wisconsin law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Wisconsin statute, and see our HIPAA vs state breach notification laws guide.

Sources