Timing of Consumer Notification
Without unreasonable delay.
Method of Notice
Mail. Phone permitted if contact is made directly with affected consumers. Email permitted if complies with E-SIGN.
Breach Definition
Unauthorized access or acquisition of computerized personal information that compromises security, confidentiality, or integrity of personal information.
PII Definition
First name or initial and last name in combination with any of these if not encrypted, redacted or otherwise altered:
  1. Social Security number;
  2. Driver’s license number;
  3. Financial account, credit card, or debit card number in combination with code or password that would permit access;
  4. Unique electronic identifier or routing number with required code or password that would permit access to person’s financial account;
  5. Medical information; or
  6. Health insurance information.
Third Party Notice
If data collector maintains covered information for someone else, it must notify them immediately following discovery of breach.
How to Notify
Notice shall include:
  • Incident in general terms; 
  • Type of personal information that was obtained as result of breach;
  • Telephone number that affected consumer may call for further information and assistance;
  • Contact information for consumer reporting agencies;
  • Advice that directs affected consumer to remain vigilant by reviewing account statements and monitoring free credit reports.
Substitute Notice
a) Email if entity has email addresses for consumers subject to notice; (b) conspicuous posting of notice on website of entity if it maintains one; and (c) notification to major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
If more than 1,000 Missouri residents must be notified.
This State's Law
State Government Agency Notification Required
Yes, Missouri Attorney General; without unreasonable delay if more than 1,000 Missouri residents must be notified.