Pennsylvania. Breach notification. Act
PA breach lawPennsylvania data breach notification law (73 Pa. Stat. § 2301 et seq. (Breach of Personal Information Notification Act))
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Pennsylvania residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account with codes, medical information (state agencies/contractors), health insurance data; online credentials.
- Key themes
- Unique features
12 months of free credit monitoring and one credit report where SSN, bank account or ID numbers are exposed; insurance-regulated entities exempt from AG notice.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Pennsylvania requires the maintaining vendor to notify the entity on discovery; vendors to state agencies have specific duties. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; AG concurrently if >500 residents; CRAs if >500; state agencies within 7 business days
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG enforcement under UTPCPL (up to $1,000 per violation, $3,000 if victim 60+)
§3Dates
- Key dates
- Adopted
- In force
- Act 151 of 2022 (eff. 2023-05-02); Act 33 of 2024 (SB 824, eff. 2024-09-26) added AG notice, credit monitoring
§4Text and authority
- Text
- Authoritative text legis.state.pa.us
- Authority
- Pennsylvania Office of Attorney General
§5Where it applies
- Domestic law of
- Pennsylvania
§6Sources and verification
- Sources consulted
- Verification
High confidence.