Privacy Law Library

Computer Security Breach Notification

MT Breach Notification

Breach notification

Montana requires businesses to notify Montana residents without unreasonable delay when unencrypted personal information is reasonably believed to have been acquired in a breach that causes or is reasonably believed to cause loss or injury. Copies of resident notices must be sent at the same time to the Attorney General's Office of Consumer Protection.

Where
Montana
Citation
Mont. Code Ann. 30-14-1704 (with 30-14-1701, 30-14-1702, 30-14-1705)
Status
In force
In force since
2005-10-01
Last amended
2015-10-01
Enforced by
Montana Department of Justice, Office of Consumer Protection (Attorney General)
People can sue
Limited
Penalties
A violation is an unfair trade practice under 30-14-103 (30-14-1705(3)): injunction, and civil fines up to $10,000 per willful violation (30-14-142). Consumers with an ascertainable loss may bring individual (not class) actions under 30-14-133.
Applies to
  • Any person or business that conducts business in Montana and owns or licenses computerized data including personal information (30-14-1704(1))
  • Persons or businesses that maintain such data for others (must notify the owner or licensee) (30-14-1704(2))
  • Insurance-industry entities regulated under Title 33 are excluded from the part's definition of 'business' and are covered instead by 33-19-321 (30-14-1702(1)(b))

Breach duties

  • Notify affected Montana residents without unreasonable delay after discovering a breach of unencrypted personal information (name plus SSN, driver's license/state/tribal ID, financial account or card number with access code, medical record information, taxpayer ID, or IRS identity protection PIN).Mont. Code Ann. 30-14-1704(1), (4)(b) · Only if: Breach materially compromises security and causes or is reasonably believed to cause loss or injury
  • Service providers maintaining data they do not own must notify the owner or licensee immediately after discovery.Mont. Code Ann. 30-14-1704(2)
  • Simultaneously send the AG's consumer protection office an electronic copy of the notice and a statement of the date and method of distribution, with the number of Montana residents notified.Mont. Code Ann. 30-14-1704(8)
  • Notice may be written, electronic (E-SIGN compliant), telephonic, or substitute notice if cost exceeds $250,000, more than 500,000 people are affected, or contact information is insufficient; delay allowed at law enforcement request.Mont. Code Ann. 30-14-1704(3), (5)
  • Coordinate with consumer reporting agencies when the notice suggests obtaining a credit file.Mont. Code Ann. 30-14-1704(7)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective dates are inferred from session-law history notes (En. Ch. 518, L. 2005; last amended Ch. 62, L. 2015) plus Montana's default October 1 rule; the session laws were not fetched. | Whether 30-14-133 private actions are available for breach-notice failures has not been confirmed by case law.

Research reference, not legal advice.