Louisiana. Breach notification. Act
LA breach lawLouisiana data breach notification law (La. Rev. Stat. §§ 51:3071 et seq.; La. Admin. Code tit. 16, pt. III, § 701)
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Louisiana residents to notify affected individuals after a security breach. Core timing rule: Individuals within 60 days of discovery. Covered data: name plus SSN, driver's licence/ID, financial account with codes, passport, biometric data.
- Key themes
- Unique features
Each day the AG lacks a required notice is a separate violation; no-harm determinations kept 5 years; private right of action for actual damages.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Louisiana requires the maintaining entity to notify the owner after discovery (no fixed days). The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 60 days of discovery; AG within 10 days of individual notice (any notifiable breach)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per violation, each day a separate violation; actual damages
§3Dates
- Key dates
- Adopted
- In force
- Act 382 (SB 361, 2018, eff. 2018-08-01) added 60-day deadline and biometrics
§4Text and authority
- Text
- Authoritative text legis.la.gov
- Authority
- Louisiana Attorney General (Consumer Protection Section)
§5Where it applies
- Domestic law of
- Louisiana
§6Sources and verification
- Sources consulted
- Verification
High confidence.