Breach notification law by state

What each U.S. jurisdiction's breach notification statute requires of an organization that discloses a breach: how quickly residents must be notified, whether the attorney general must be told, what a credit freeze costs, and whether identity theft monitoring must be offered. 51 jurisdictions are recorded, of which 21 set a fixed notification deadline in days.

This is a reference summary of statutory text, not legal advice, and it does not describe any particular breach. BreachBook is not a law firm and cannot advise on how a statute applies to an individual case. Each entry cites the statute and the date it was last verified.

Breach notification statute summary for each U.S. jurisdiction
Jurisdiction	Notice deadline	Attorney general notice	Credit freeze	Monitoring
Alabama	45 days	1,001 or more residents	free	not required
Alaska	no fixed period	not required	free	not required
Arizona	45 days	1,001 or more residents	free	not required
Arkansas	no fixed period	1,001 or more residents	free	not required
California	no fixed period	501 or more residents	free	not required
Colorado	30 days	500 or more residents	free	not required
Connecticut	60 days	every breach	free	24 months
Delaware	60 days	501 or more residents	free	12 months
District of Columbia	no fixed period	50 or more residents	free	18 months
Florida	30 days	500 or more residents	free	not required
Georgia	no fixed period	not required	free	not required
Hawaii	no fixed period	1,001 or more residents	free	not required
Idaho	no fixed period	not required	free	not required
Illinois	no fixed period	501 or more residents	free	not required
Indiana	45 days	every breach	free	not required
Iowa	no fixed period	501 or more residents	free	not required
Kansas	no fixed period	not required	free	not required
Kentucky	no fixed period	not required	free	not required
Louisiana	60 days	every breach	free	not required
Maine	30 days	every breach	free	not required
Maryland	45 days	every breach	free	not required
Massachusetts	no fixed period	every breach	free	18 months
Michigan	no fixed period	not required	free	not required
Minnesota	no fixed period	not required	free	not required
Mississippi	no fixed period	not required	free	not required
Missouri	no fixed period	1,001 or more residents	free	not required
Montana	no fixed period	every breach	free	not required
Nebraska	no fixed period	every breach	free	not required
Nevada	no fixed period	not required	free	not required
New Hampshire	no fixed period	every breach	free	not required
New Jersey	no fixed period	every breach	free	not required
New Mexico	45 days	1,001 or more residents	free	not required
New York	30 days	every breach	free	not required
North Carolina	no fixed period	every breach	free	not required
North Dakota	no fixed period	251 or more residents	free	not required
Ohio	45 days	not required	free	not required
Oklahoma	no fixed period	500 or more residents	free	not required
Oregon	45 days	251 or more residents	free	not required
Pennsylvania	no fixed period	501 or more residents	free	12 months
Rhode Island	45 days	501 or more residents	free	not required
South Carolina	no fixed period	1,001 or more residents	free	not required
South Dakota	60 days	251 or more residents	free	not required
Tennessee	45 days	not required	free	not required
Texas	60 days	250 or more residents	free	not required
Utah	no fixed period	500 or more residents	free	not required
Vermont	45 days	every breach	free	not required
Virginia	no fixed period	every breach	free	not required
Washington	30 days	501 or more residents	free	not required
West Virginia	no fixed period	not required	free	not required
Wisconsin	45 days	not required	free	not required
Wyoming	no fixed period	not required	free	not required

Found an error in one of these entries? See the corrections policy.