Florida. Breach notification. Act
FL breach lawFlorida data breach notification law (Fla. Stat. § 501.171 (Florida Information Protection Act of 2014))
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Florida residents to notify affected individuals after a security breach. Core timing rule: Individuals within 30 days of determination (15-day extension for good cause). Covered data: name plus SSN, government ID numbers, financial account with codes, medical and health insurance data, biometric/genetic and geolocation data; online credentials.
- Key themes
- Unique features
Regulator can demand forensic reports and breach policies; vendor failure is attributed to the covered entity; documented no-harm determinations must go to the Department within 30 days.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Florida requires a third-party agent to notify the covered entity within 10 days of determining or suspecting a breach, and its failure counts as the covered entity's violation. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 30 days of determination (15-day extension for good cause); Department of Legal Affairs within 30 days if >=500 residents; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $1,000/day for first 30 days, $50,000 per 30-day period up to 180 days, max $500,000 per breach
§3Dates
- Key dates
- Adopted
- In force
- SB 262 (2023) added biometric, genetic and geolocation data effective 2024-07-01
§4Text and authority
- Text
- Authoritative text leg.state.fl.us
- Authority
- Florida Department of Legal Affairs (Attorney General)
§5Where it applies
- Domestic law of
- Florida
§6Sources and verification
- Sources consulted
- Verification
High confidence.