Montana. Breach notification. Act
MT breach lawMontana data breach notification law (Mont. Code §§ 30-14-1701 et seq.; 2-6-1501 et seq.; 33-19-321)
Partly verified
Medium confidence.Penalty figure from Montana Consumer Protection Act general provision.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Montana residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/state/tribal ID, financial account with codes, medical records, taxpayer ID, IRS IP PIN.
- Key themes
- Unique features
Simultaneous electronic copy of notice to the AG consumer protection office for all breaches; insurers report to the Insurance Commissioner.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Montana requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; AG Office of Consumer Protection simultaneously for every notifiable breach
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Unfair trade practice; up to $10,000 per wilful violation
§3Dates
- Key dates
- Adopted
- In force
- SB 50 (2023, eff. 2023-10-01) added tribal ID, medical records and IRS IP PIN
§4Text and authority
- Text
- Authoritative text archive.legmt.gov
- Authority
- Montana Department of Justice, Office of Consumer Protection
§5Where it applies
- Domestic law of
- Montana
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figure from Montana Consumer Protection Act general provision.