State Data Breach Laws


As of April 16, 2010

Forty-six states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information.

The table below contains links to each state law.

Alaska 2008 H.B. 65
Arizona Ariz. Rev. Stat. § 44-7501
Arkansas Ark. Code § 4-110-101 et seq.
California Cal. Civ. Code § 56.061785.11.21798.291798.82
Colorado Colo. Rev. Stat. § 6-1-716
Connecticut Conn. Gen Stat. 36a-701(b)
Delaware Del. Code tit. 6, § 12B-101 et seq.
Florida Fla. Stat. § 817.5681
Georgia Ga. Code § 10-1-910, -911
Hawaii Haw. Rev. Stat. § 487N-2
Idaho Idaho Code § 28-51-104 to 28-51-107
Illinois 815 ILCS 530/1 et seq.
Indiana Ind. Code § 24-4.9 et seq.,  4-1-11 et seq.
Iowa Iowa Code § 715C.1 (2008 S.F. 2308)
Kansas Kan. Stat. 50-7a01,  50-7a02
Louisiana La. Rev. Stat. § 51:3071 et seq. 
Maine Me. Rev. Stat. tit. 10 § 1347 et seq.
Maryland Senate Bill 134,
Com. Law § 14-3501 et seq.
Massachusetts Mass. Gen. Laws § 93H 
201 CMR 17.00 Implements the provisions of 93H.
201 CMR 17.00 Frequently Asked Question
201 CMR 17.00 Compliance Checklist 
Michigan Mich. Comp. Laws § 445.72
Minnesota Minn. Stat. § 325E.61325E.64
Mississippi House Bill 583 (effective July 1, 2011)
Missouri House Bill 62
Montana Mont. Code § 30-14-1701 et seq.
Nebraska Neb. Rev. Stat. § 87-801-802, -803, -804, -805, -806, -807
Nevada Nev. Rev. Stat. 603A.010 et seq. 
New Hampshire N.H. Rev. Stat. § 359-C:19, -C:20, -C:21
New Jersey N.J. Stat. 56:8-163
Cyber Security Resources
Info Secure Newsletter Volume 3, Issue 6
New York N.Y. Gen. Bus. Law § 899-aa
North Carolina N.C. Gen. Stat § 75-65
North Dakota N.D. Cent. Code § 51-30-01 et seq.
Ohio Ohio Rev. Code § 1347.121349.19, 1349.191, 1349.192
Oklahoma Okla. Stat. § 74-3113.1 and 2008 H.B. 2245
Oregon 2007 S.B. 583, Chapter 759
Pennsylvania 73 Pa. Stat. § 2303
Rhode Island R.I. Gen. Laws § 11-49.2-1 et seq.
South Carolina 2008 S.B. 453, Act 190
Tennessee Tenn. Code § 47-18-2107
Texas Tex. Bus. & Com. Code § 48.001 et seq.
Utah Utah Code §  13-44-101, -102, -201, -202, -310
Vermont Vt. Stat. tit. 9 § 2430 et seq.
Virginia Va. Code § 18.2-186.6 
Washington Wash. Rev. Code § 19.255.010
West Virginia W.V. Code § 46A-2A-101 et seq.
Wisconsin Wis. Stat. § 134.98  et seq. 
Wyoming Wyo. Stat. § 40-12-501 to -501
District of Columbia D.C. Code § 28- 3851 et seq.
Puerto Rico 10 Laws of Puerto Rico § 4051 et. seq.
Virgin Islands V.I. Code § 2208

 

States with no security breach law: Alabama, Kentucky, New Mexico, and South Dakota.

 

Other sources of information are:
- CSO Disclosure Series Data Breach Notification Laws.
- The National Conference of State Legislatures (NCSL) Web site.