Privacy Map

Arkansas. Breach notification. Act

AR breach lawArkansas data breach notification law (Ark. Code §§ 4-110-101 et seq. (Personal Information Protection Act))

In force
Partly verifiedMedium confidence. Penalty figure is the general ADTPA cap; not confirmed on summary page. text_url points to Justia because the official code is hosted on LexisNexis.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Arkansas residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/state ID, financial account with codes, medical information, and biometric data.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Includes biometric and medical data; no-harm determinations must be retained for five years.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Arkansas requires the maintaining entity to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals in the most expedient time possible; AG if >1,000 residents, at the same time as individuals or within 45 days of determining likely harm, whichever is first
DPO
No
Cross-border transfers
None
Maximum penalty
Enforced by the AG under the Deceptive Trade Practices Act (civil penalties up to $10,000 per violation)

§3Dates

Key dates
  • Adopted
  • In force
  • Amended by Act 1030 of 2019 (HB 1943, eff. 2019-07-23) adding biometrics and AG notice

§4Text and authority

Text
Authority
Arkansas Attorney General

§5Where it applies

Domestic law of
Arkansas

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Penalty figure is the general ADTPA cap; not confirmed on summary page. text_url points to Justia because the official code is hosted on LexisNexis.