Wisconsin. Breach notification. Act
WI breach lawWisconsin data breach notification law (Wis. Stat. § 134.98)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Wisconsin residents to notify affected individuals after a security breach. Core timing rule: Individuals within a reasonable time not exceeding 45 days of learning of the breach. Covered data: name plus SSN, driver's licence/ID, financial account numbers or codes, DNA profile, biometric data.
- Key themes
- Unique features
Includes DNA profile; failure to comply may be evidence of negligence rather than a standalone penalty.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Wisconsin requires the storing entity to notify the owner as soon as practicable unless a contract provides otherwise. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within a reasonable time not exceeding 45 days of learning of the breach; CRAs if >=1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Not specified
§3Dates
- Key dates
- Adopted
- In force
- No amendment identified since enactment
§4Text and authority
- Text
- Authoritative text docs.legis.wisconsin.gov
- Authority
- Wisconsin Department of Agriculture, Trade and Consumer Protection
§5Where it applies
- Domestic law of
- Wisconsin
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.