Alaska. Breach notification. Act
AK breach lawAlaska data breach notification law (Alaska Stat. § 45.48.010 et seq. (Personal Information Protection Act))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Alaska residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expeditious time possible, no fixed days. Covered data: name plus SSN, driver's licence/state ID, financial account or card numbers, and financial-account passwords/PINs.
- Key themes
- Unique features
Risk-of-harm exception is available only if the entity documents its no-harm finding in writing and notifies the AG; one of the narrower PI definitions (no health, biometric or online credentials).
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: the maintaining entity must notify the owner or licensor and cooperate, with no fixed deadline. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expeditious time possible, no fixed days; AG only when relying on no-harm determination; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $500 per resident not notified, capped at $50,000; injured persons may sue non-governmental entities
§3Dates
- Key dates
- Adopted
- In force
- Enacted by HB 65 (2008); no later amendment identified
§4Text and authority
- Text
- Authoritative text akleg.gov
- Authority
- Alaska Department of Law (Attorney General)
§5Where it applies
- Domestic law of
- Alaska
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.