Regulations library · US states
State breach laws
US state data breach notification laws
In force US states breach notification
Every state requires notice to affected residents after a breach of personal information. Deadlines, regulator notices and what counts as personal information differ, so a multi-state breach means applying several laws at once.
At a glance
- Who it applies to
- Any organization holding personal information of residents of the state.
- Who enforces it
- State Attorneys General
- When
- In force in all 50 states, the District of Columbia, Puerto Rico, Guam and the US Virgin Islands. Definitions, deadlines and regulator notices differ.
This is a reference entry. The priority laws get a full practical guide first.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
Primary sources are being added to this entry.
Dates and status are from the association's inventory and are being checked against primary sources. This page explains the law for practitioners; it is not legal advice.