Nevada. Breach notification. Act
NV breach lawNevada data breach notification law (Nev. Rev. Stat. §§ 603A.010 et seq.)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Nevada residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account with codes, medical/health insurance ID; online credentials.
- Key themes
- Unique features
Mandates encryption of personal information in transmission and on portable devices, and PCI DSS compliance for card data, with a safe harbour for compliant data collectors.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Nevada requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; no AG notice; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG or district attorney injunctions; no specific civil penalty in breach section
§3Dates
- Key dates
- Adopted
- In force
- AB 179 (2015, eff. 2015-07-01) added health insurance ID and credentials
§4Text and authority
- Text
- Authoritative text leg.state.nv.us
- Authority
- Nevada Attorney General
§5Where it applies
- Domestic law of
- Nevada
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.