Mintz Matrix

State Data Security Breach Notification Laws

As data breaches dominate national headlines it remains important as ever for businesses to invest in security and to be ready to respond if a breach occurs. Part of your preparedness program should be staying current on data breach legislation at the state level and we are here to help with our “Mintz Matrix,” a detailed survey of U.S. state data breach notification laws.

Click here to download a print-version of the Mintz Matrix

The general definition of “personal information” used in the majority of statutes is: An individual’s first name or first initial and last name plus one or more of the following data elements: (i) Social Security number, (ii) driver’s license number or state-issued identification card number, and (iii) account number, credit card number or debit card number combined with any security code, access code, PIN or password needed to access an account. The general definition generally applies to computerized data that includes personal information and usually excludes publicly available information that is lawfully made available to the general public from federal, state or local governments or widely distributed media. When a statute varies from this general definition, it will be pointed out and underlined in the chart.

The term “security breach” is used in this chart to capture the concept variably described in state statutes as a “security breach,” “breach of the security,” “breach of the security system,” or “breach of the security of the system,” among other descriptions.

For those entities doing business in Texas, be sure to review the relevant Texas law. This chart does not include information on the California Consumer Privacy Act. 

Please note that rules applicable to state agencies, government bodies and other public institutions are not discussed in this chart.