Maine. Breach notification. Act
ME breach lawMaine data breach notification law (10 Me. Rev. Stat. § 1346 et seq. (Notice of Risk to Personal Data Act))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Maine residents to notify affected individuals after a security breach. Core timing rule: Individuals within 30 days of becoming aware and identifying scope. Covered data: name plus SSN, driver's licence/ID, account numbers, passwords/PINs; any element alone if enough for identity fraud.
- Key themes
- Unique features
Fixed 30-day deadline; law-enforcement delay ends 7 business days after clearance; covers information brokers as well as general businesses.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Maine requires the maintaining third party to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 30 days of becoming aware and identifying scope; AG or DPFR regulator whenever individuals notified; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $500 per violation, up to $2,500 per day
§3Dates
- Key dates
- Adopted
- In force
- LD 696 (Ch. 512, eff. 2019-09-19) added 30-day deadline
§4Text and authority
- Text
- Authoritative text legislature.maine.gov
- Authority
- Maine Attorney General / Department of Professional and Financial Regulation
§5Where it applies
- Domestic law of
- Maine
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.