Database Security Breach Notification Law
LA DSBNL
Breach notification · Data security · Biometric
Louisiana's breach law requires businesses and agencies to protect computerized personal information with reasonable security, destroy it securely when no longer retained, and notify affected Louisiana residents within 60 days of discovering a breach. An Attorney General rule adds notice to the AG within 10 days of notifying residents. Personal information is name plus SSN, driver's license or state ID number, financial account or card number with access code, passport number, or biometric data.
- Where
- Louisiana
- Citation
- La. R.S. 51:3071 to 51:3077; La. Admin. Code tit. 16, pt. III, § 701
- Status
- In force
- In force since
- 2006-01-01
- Last amended
- 2018-08-01
- Enforced by
- Louisiana Attorney General (Consumer Protection Section)
- People can sue
- Limited
- Penalties
- A violation is an unfair act or practice under LUTPA, R.S. 51:1405(A). Individuals may sue for actual damages caused by untimely notice (R.S. 51:3075). The AG rule makes late notice to the AG punishable by a fine up to $5,000 per violation, with each day counting as a separate violation.
- Applies to
- Any person that conducts business in Louisiana or owns or licenses computerized data that includes personal information of Louisiana residents
- State agencies and political subdivisions that own or license such data
- Persons and agencies that maintain such data on behalf of an owner or licensee (notice-to-owner duty)
Security duties
- Take all reasonable steps to destroy records containing personal information that will no longer be retained, by shredding, erasing, or otherwise making it unreadable.La. R.S. 51:3074(B)
- Implement and maintain reasonable security procedures and practices appropriate to the nature of personal information to protect it from unauthorized access, destruction, use, modification, or disclosure.La. R.S. 51:3074(A)
Breach duties
- Substitute notice (email, website posting, and statewide media) is allowed when costs exceed $100,000, more than 100,000 people are affected, or contact information is insufficient.La. R.S. 51:3074(G)(3)
- If notification is delayed for law enforcement or to scope and remediate the breach, give the AG written reasons for the delay within the 60-day period.La. R.S. 51:3074(E) · Only if: Only when notice is delayed
- A person or agency that maintains data it does not own must notify the owner or licensee following discovery of a breach.La. R.S. 51:3074(D)
- Send written notice to the AG Consumer Protection Section, including the names of all affected Louisiana residents, within 10 days of distributing notice to residents.La. Admin. Code tit. 16, pt. III, § 701
- Notify affected Louisiana residents of a breach in the most expedient time possible and no later than 60 days after discovery, subject to law enforcement delay.La. R.S. 51:3074(C), (E)-(F)
Other duties
- If no notice is given because a reasonable investigation finds no reasonable likelihood of harm, keep the written determination for five years and send it to the AG within 30 days of a written request.La. R.S. 51:3074(I)
Sources
- Official text
- La. R.S. 51:3073 Definitions (Louisiana Legislature)
- La. R.S. 51:3074 (Louisiana Legislature)
- La. R.S. 51:3075 Recovery of damages (Louisiana Legislature)
- La. R.S. 51:3076 Financial institutions (Louisiana Legislature)
- Louisiana Attorney General, Data Security Breach Notification (LAC 16:III.701 text)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The 2018 amendment (Acts 2018, No. 382) effective date is given as August 1, 2018 on the assumption it took the default effective date; the statute history note does not state it. | LAC 16:III.701 promulgation date not confirmed from the Louisiana Register; text taken from the AG's page (and matched against Cornell LII's copy).
Research reference, not legal advice.