State Privacy and Data Breach Notification Laws


All but three U.S. states have enacted privacy and data breach notification laws to protect the personally identifiable information (PII) of consumers. Non-compliance with many of these laws carries financial penalties, but also reputational damage, potentially leading to bankruptcy. Below are links to each state’s privacy and/or data breach notification laws.

Reflexion assists thousands of businesses across the U.S. in complying with these laws, both from an email archiving and encryption standpoint — including the implementation of pre-defined subject matter lexicons for many of the larger states — and individual lexicons to identify PII, such as social security numbers, drivers license numbers, credit card information and more.

A recent U.S. Cost of a Data Breach report by the Ponemon Institute found that security breaches cost companies an average $214 per compromised record and $7.2 million per data breach event. Security breaches have direct costs — such as notification and legal defense — and indirect costs to your bottom line, like lost customers.

To learn more about Reflexion’s Compliance Suite, please contact us; or for solution providers, register today for your free internal evaluation.

State Citation
Alaska Alaska Stat. § 45.48.010 et seq.
Arizona Ariz. Rev. Stat. § 44-7501
Arkansas Ark. Code § 4-110-101 et seq.
California Cal. Civ. Code §§ 1798.291798.80 et seq.
Colorado Colo. Rev. Stat. § 6-1-716
Connecticut Conn. Gen Stat. § 36a-701b
Delaware Del. Code tit. 6, § 12B-101 et seq.
Florida Fla. Stat. §§ 501.171, 282.0041, 282.318(2)(i)  (2014 S.B. 1524, S.B. 1526)
Georgia Ga. Code §§ 10-1-910, -911, -912; § 46-5-214
Hawaii Haw. Rev. Stat. § 487N-1 et seq.
Idaho Idaho Stat. §§ 28-51-104 to -107
Illinois 815 ILCS §§ 530/1 to 530/25
Indiana Ind. Code §§ 4-1-11 et seq., 24-4.9 et seq.
Iowa Iowa Code §§ 715C.1, 715C.2
Kansas Kan. Stat. § 50-7a01 et seq. 
Kentucky KRS § 365.732, KRS §§ 61.931 to 61.934 (2014 H.B. 5, H.B. 232)
Louisiana La. Rev. Stat. § 51:3071 et seq., 40:1300.111 to .116 (2014 H.B. 350)
Maine Me. Rev. Stat. tit. 10 § 1347 et seq.
Maryland Md. Code Com. Law §§ 14-3501 et seq., Md. State Govt. Code §§ 10-1301 to -1308
Massachusetts Mass. Gen. Laws § 93H-1 et seq.
Michigan Mich. Comp. Laws §§ 445.63, 445.72
Minnesota Minn. Stat. §§ 325E.61, 325E.64
Mississippi Miss. Code § 75-24-29
Missouri Mo. Rev. Stat. § 407.1500
Montana Mont. Code § 2-6-504, 30-14-1701 et seq.
Nebraska Neb. Rev. Stat. §§ 87-801, -802, -803, -804, -805, -806, -807
Nevada Nev. Rev. Stat. §§  603A.010 et seq., 242.183
New Hampshire N.H. Rev. Stat. §§ 359-C:19, -C:20, -C:21
New Jersey N.J. Stat. § 56:8-163
New York N.Y. Gen. Bus. Law § 899-aa, N.Y. State Tech. Law 208
North Carolina N.C. Gen. Stat §§ 75-61, 75-65
North Dakota N.D. Cent. Code § 51-30-01 et seq.
Ohio Ohio Rev. Code §§ 1347.121349.19, 1349.191, 1349.192
Oklahoma Okla. Stat. §§ 74-3113.1, 24-161 to -166
Oregon Oregon Rev. Stat. § 646A.600 to .628
Pennsylvania 73 Pa. Stat. § 2301 et seq.
Rhode Island R.I. Gen. Laws § 11-49.2-1 et seq.
South Carolina  S.C. Code § 39-1-90, 2013 H.B. 3248
Tennessee Tenn. Code § 47-18-2107
Texas Tex. Bus. & Com. Code §§ 521.002, 521.053, Tex. Ed. Code § 37.007(b)(5)
Utah Utah Code §§  13-44-101 et seq.
Vermont Vt. Stat. tit. 9 § 2430, 2435
Virginia  Va. Code § 18.2-186.6, § 32.1-127.1:05
Washington Wash. Rev. Code § 19.255.010, 42.56.590
West Virginia  W.V. Code §§ 46A-2A-101 et seq.
Wisconsin Wis. Stat. § 134.98
Wyoming Wyo. Stat. § 40-12-501 et seq.
District of Columbia D.C. Code § 28- 3851 et seq.
Guam  9 GCA § 48-10 et seq.
Puerto Rico 10 Laws of Puerto Rico § 4051 et seq.
Virgin Islands  V.I. Code tit. 14, § 2208

States with no security breach laws: Alabama, New Mexico and South Dakota. Data from the National Conference of State Legislatures (NCSL.org)