Timing of Consumer Notification
“No later than 45 days from discovery or notification of breach.”
Method of Notice
Mail. Email permitted if complies with E-SIGN.
Breach Definition
Unauthorized acquisition of unencrypted computerized data that materially compromises security, confidentiality or integrity of personal information maintained by information holder.
PII Definition
Individual's first name or first initial and last name in combination with any of these when unencrypted:
  1. Social Security number;
  2. Driver's license number; or
  3. Account, credit card, or debit card number, in combination with any required security code, access code, or password that would permit access to financial account.
Third Party Notice
If entity maintains covered information for someone else, it must notify them no later than 45 days from discovery or notification of breach.
How to Notify
No specific content requirement.
Substitute Notice
All: (a) email notice when entity has email address; (b) conspicuous posting of notice on website of entity if entity maintains a one; or (c) notice to major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
If more than 1,000 persons must be notified at one time.
This State's Law
State Government Agency Notification Required
Not required.