Florida’s cybersecurity laws come in three layers: a data-protection statute that governs any business or agency holding personal information on Florida residents, a set of security and incident-reporting rules for state and local government, and criminal statutes punishing unauthorized access to computers and devices. Civil penalties for late breach notice run up to $500,000 per breach, and the worst criminal computer offenses can be charged as first-degree felonies.
Who Has to Comply
The Florida Information Protection Act, at Florida Statutes section 501.171, reaches any entity that acquires, uses, stores, or maintains personal information belonging to Florida residents. You do not need an office or employees in the state. Sole proprietorships, corporations, government entities, and the third-party vendors they hire to handle data are all covered.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
The law kicks in when a person’s first name or first initial and last name appear in a record together with any unencrypted sensitive data element. Those elements include Social Security numbers; driver’s license, passport, or military ID numbers; financial account or card numbers paired with the security code or password that unlocks the account; medical information from a healthcare professional; health insurance identifiers; biometric data; and geolocation information.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
A username or email combined with the password or security answer that unlocks an online account counts as personal information on its own, with no name required. Encrypted data and information already lawfully made public by a government entity fall outside the definition.
Protecting and Disposing of Data
Every covered entity, government entity, and third-party agent must take reasonable measures to protect electronic data containing personal information. The statute does not name a specific framework, so what qualifies as reasonable scales with the volume and sensitivity of what you hold.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
When records containing personal information are no longer needed, you have to shred, erase, or otherwise modify the data so it cannot be read or reconstructed. The disposal duty binds covered entities and their third-party agents alike.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
Breach Notification Deadlines
Under FIPA, a breach is unauthorized access to electronic data containing personal information. Good-faith access by an employee or agent is excluded, as long as the information is not used for an unrelated purpose or disclosed further without authorization.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
Once you determine a breach has occurred, you have 30 days to notify every affected Florida resident whose personal information was accessed or reasonably believed to have been accessed. The notice must give the date or estimated date range of the breach, a description of the information involved, and contact information the person can use to reach you. If you can show good cause, you may request an additional 15 days by writing to the Department of Legal Affairs within the original 30-day window.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
A breach affecting 500 or more Florida residents triggers a separate written notice to the Department of Legal Affairs within the same 30-day period. At 1,000 or more affected individuals, you also have to notify all nationwide consumer reporting agencies about the timing, distribution, and content of the individual notices.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
When the breach happens on a third-party agent’s system, that agent has 10 days from discovery to notify the covered entity. The compressed window exists so the primary entity still has time to meet its own 30-day deadlines.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
Civil Penalties and Who Can Sue
Missing the notification deadline carries escalating civil penalties calculated per breach, not per person affected. For the first 30 days past the deadline, the penalty is $1,000 per day. For each 30-day period after that, up to 180 days, it rises to $50,000 per period. Beyond 180 days, the total cannot exceed $500,000 per breach.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
FIPA violations are treated as unfair or deceptive trade practices, and the Florida Department of Legal Affairs brings the enforcement action. The statute explicitly says it does not create a private cause of action. Consumers whose data was mishandled cannot sue the company under FIPA; enforcement runs through the state.1Online Sunshine. Florida Code 501.171 – Security of Confidential Personal Information
Rules for State Agencies
State agencies answer to a more prescriptive statute, section 282.318. The Florida Digital Service, housed within the Department of Management Services, sets the standards, and every state agency has to build and maintain a cybersecurity program aligned with them.2Florida Senate. Florida Code 282.318 – Cybersecurity
Incident reporting runs on a severity-based clock. Level 3, 4, or 5 cybersecurity incidents must be reported to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement within 48 hours of discovery. Ransomware incidents must be reported within 12 hours. Each report has to include a summary of the facts.2Florida Senate. Florida Code 282.318 – Cybersecurity
Rules for Local Governments
Counties and municipalities operate under the Local Government Cybersecurity Act at section 282.3185. They must adopt cybersecurity standards consistent with generally accepted best practices, including the NIST Cybersecurity Framework. Deadlines were staggered by size: counties with 75,000 or more residents and municipalities with 25,000 or more had to comply by January 1, 2024; smaller jurisdictions had until January 1, 2025.3Online Sunshine. Florida Code 282.3185 – Local Government Cybersecurity
The incident-reporting timeline mirrors the state’s: 48 hours for Level 3, 4, or 5 incidents and 12 hours for ransomware. Local governments send those reports to the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement, and the sheriff with jurisdiction.3Online Sunshine. Florida Code 282.3185 – Local Government Cybersecurity
Training is also mandatory. All local government employees with network access must complete basic cybersecurity training within 30 days of starting and annually afterward. Technology professionals and employees with access to highly sensitive information have to complete an advanced curriculum on the same schedule.3Online Sunshine. Florida Code 282.3185 – Local Government Cybersecurity
Criminal Penalties for Hacking
Chapter 815 criminalizes the conduct behind many breaches. Knowingly accessing a computer without authorization, disrupting data transmission, destroying equipment, introducing malware, or conducting unauthorized audio or video surveillance through a device’s built-in features is a third-degree felony. The charge rises to a second-degree felony when the offense involves damage of $5,000 or more, is part of a fraud scheme, disrupts government operations or public services like water or transportation, or targets a public transit system.4Online Sunshine. Florida Code 815.06 – Offenses Against Users of Computers, Computer Systems, Computer Networks, and Electronic Devices
The top tier is a first-degree felony, reserved for unauthorized activity that endangers human life or disrupts computer systems or electronic devices tied to medical equipment used in direct patient care.4Online Sunshine. Florida Code 815.06 – Offenses Against Users of Computers, Computer Systems, Computer Networks, and Electronic Devices
A related provision at section 815.04 punishes people who knowingly introduce computer contaminants, destroy data, or disclose trade secrets or legally confidential information stored in a computer system. That offense is a third-degree felony, raised to the second degree when it is part of a fraud scheme.5Online Sunshine. Florida Code Chapter 815 – Computer-Related Crimes
Where Patient Records Can Be Stored
Healthcare providers in Florida face a geographic restriction that goes further than HIPAA. Under the Florida Electronic Health Records Exchange Act at section 408.051, a provider using certified electronic health record technology must ensure that any patient information stored offsite, including with a third-party data center or cloud computing service, is physically located in the continental United States, its territories, or Canada. The restriction covers all qualified electronic health records held through technology that allows electronic retrieval, access, or transmission.6Online Sunshine. Florida Code 408.051 – Florida Electronic Health Records Exchange Act
Many cloud providers operate data centers globally, so contracts with EHR vendors need written guarantees about where records physically reside.
How Federal Rules Fit In
Florida’s regime sits alongside federal obligations rather than replacing them. Healthcare providers still owe HIPAA security and breach-notification duties on top of FIPA and the EHR storage rule. Financial institutions remain bound by the Gramm-Leach-Bliley Act. FIPA allows federally regulated entities to follow their federal notification procedures, but they still have to send the required notice to the Florida Department of Legal Affairs.