Michigan. Breach notification. Act
MI breach lawMichigan data breach notification law (Mich. Comp. Laws §§ 445.63, 445.72 (Identity Theft Protection Act))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Michigan residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account or card numbers with codes.
- Key themes
- Unique features
Criminal penalties for false or deceptive breach notices; fine capped per breach.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Michigan requires the maintaining entity to notify the owner unless it determines no substantial loss or identity theft is likely. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; no AG notice; CRAs if >=1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $250 per failure to notify, max $750,000 per breach
§3Dates
- Key dates
- Adopted
- In force
- SB 223 (2010); HB 6406 (2018) and HB 6491 (Insurance Data Security, eff. 2021-01-20) for insurers
§4Text and authority
- Text
- Authoritative text legislature.mi.gov
- Authority
- Michigan Attorney General
§5Where it applies
- Domestic law of
- Michigan
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.