Florida’s data governance laws sit in three main places: the Florida Information Protection Act (FIPA) governs how any business or agency holding personal information must secure it and report breaches; the Florida Digital Bill of Rights adds consumer privacy rights that apply only to the largest technology companies; and Chapter 282 of the Florida Statutes imposes a detailed cybersecurity regime on state agencies. Federal laws like HIPAA and FERPA layer on top for health data and student records. Penalties for ignoring the state rules can run up to $500,000 per breach, and federal health-data fines reach into the millions.
FIPA: The Baseline Rule for Anyone Holding Personal Data
FIPA, codified at Section 501.171 of the Florida Statutes, is the law most Florida businesses will deal with first. It applies to any entity that collects, stores, or uses personal information in electronic form, and it requires reasonable measures to protect that information.1Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information
The statute defines “personal information” as an individual’s name paired with at least one sensitive identifier: Social Security number, driver’s license or state ID number, a financial account number with its access credentials, medical history or treatment information, health insurance identifiers, or an email address paired with the password or security questions that would open an online account. Data that has been encrypted or otherwise made unreadable falls outside the definition, which is why encryption is the single most useful control a covered entity can put in place.
“Covered entity” is drawn broadly. Sole proprietorships, partnerships, corporations, trusts, estates, cooperatives, associations, and other commercial entities all fall within it, as do government entities. Third-party vendors handling data on behalf of a covered entity have their own duty to report breaches back to the entity they serve.1Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information
The Two Notification Clocks
If a breach affects 500 or more Florida residents, you must notify the Department of Legal Affairs within 30 days of discovering it or having reason to believe one occurred. A written request can buy you an additional 15 days, but the request itself has to arrive inside the original 30-day window.
A separate 30-day clock runs for individual notice. Every Florida resident whose data was accessed must be told directly within 30 days. Law enforcement can request a written delay if notification would interfere with a criminal investigation, but absent that, the clock is firm.2The Florida Legislature. Florida Code 501.171 – Security of Confidential Personal Information
The Florida Digital Bill of Rights: Narrow but Real
The Florida Digital Bill of Rights (Sections 501.701–501.721) took effect July 1, 2024.3Florida Senate. Florida Senate Bill 262 (2023) – Florida Digital Bill of Rights It looks like a general consumer privacy law, but its reach is deliberately narrow. The law applies only to entities with more than $1 billion in global gross annual revenue that also meet at least one of three further tests: they derive at least half their revenue from online advertising, they operate a consumer smart speaker with a cloud-connected virtual assistant, or they run an app store with at least 250,000 available applications.
If a company clears that bar, consumers can submit requests to exercise specified rights, including access to and deletion of their personal data. The Department of Legal Affairs enforces the law. In its first annual enforcement report, covering the period through early 2026, the department reported that no penalties had been issued or collected.4Florida Department of Legal Affairs. Florida Digital Bill of Rights Annual Enforcement Report
If you run a mid-sized Florida business, the Digital Bill of Rights almost certainly does not apply to you. FIPA still does.
Cybersecurity Requirements for State Agencies
Section 282.318 of the Florida Statutes imposes a cybersecurity framework on state agencies that goes well beyond what private businesses face. The Florida Digital Service sets statewide standards consistent with the NIST Cybersecurity Framework, and each agency head must build a program around them.5Florida Senate. Florida Code 282.318 – Enterprise Security of Data and Information Technology
At minimum, every agency must:
- Designate an information security manager and report that designation in writing to the department by January 1 each year.
- Submit an annual cybersecurity plan by July 31, covering both a three-year strategic outlook and a current-year operational plan with measurable objectives.
- Conduct a comprehensive risk assessment every three years using the department’s methodology. A private vendor can perform it, but must attest to the findings.
- Stand up a cybersecurity response team that convenes immediately when an incident is discovered.
- Provide cybersecurity awareness training to every new employee within 30 days of their start date.
- Run periodic internal audits of the cybersecurity program.
Incident Reporting Deadlines
Agency reporting clocks are much shorter than FIPA’s. Ransomware incidents must be reported to both the Cybersecurity Operations Center and the Florida Department of Law Enforcement within 12 hours of discovery. Other incidents rated severity level 3 or higher carry a 48-hour deadline. Lower-severity incidents must be reported “as soon as possible,” and once an incident is remediated, the agency has one week to file an after-action report.6The Florida Legislature. Florida Code 282.318 – Enterprise Security of Data and Information Technology
Records Retention and Destruction
Florida’s Public Records Law (Chapter 119) defines public records broadly to include any document, photograph, recording, data file, or other material made or received in connection with official government business, regardless of format.7Florida Department of State. Division of Library and Information Services – Records Management FAQ State agencies follow general records schedules that set minimum retention periods. You can keep records longer than the schedule requires. You cannot keep them for less time.
When records containing confidential or exempt information reach the end of their retention period, Florida law dictates how they must be destroyed. Paper records can be burned in an industrial facility, pulped, pulverized, shredded, or macerated; water-repellent or high-wet-strength papers cannot be pulped alone and must be shredded or burned. Electronic records require physical destruction of the storage media, high-level overwriting that renders the data unrecoverable, or degaussing. Non-paper media such as audio tape, video tape, and microfilm must be pulverized, shredded, or chemically decomposed. Burying records is explicitly prohibited because it does not guarantee destruction.8Florida Department of State. Approved Methods of Destruction
Penalties for Noncompliance
FIPA
Failing to provide required breach notifications triggers escalating civil penalties. The entity faces $1,000 per day for the first 30 days, then $50,000 for each subsequent 30-day period up to 180 days. If the violation continues beyond 180 days, the total penalty can reach $500,000. Those penalties apply per breach, not per affected individual. The Department of Legal Affairs may also treat violations as unfair or deceptive trade practices, which opens the door to additional remedies.1Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information
HIPAA for Health Data
Any Florida business or agency handling protected health information also faces federal penalties under HIPAA. The structure has four tiers based on the violator’s level of fault, and the amounts are adjusted each year for inflation. For 2026:
- No knowledge of the violation: $145 to $73,011 per violation, with a calendar-year cap of $2,190,294.
- Reasonable cause but not willful neglect: $1,461 to $73,011 per violation, same annual cap.
- Willful neglect corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
- Willful neglect not corrected within 30 days: $73,011 to $2,190,294 per violation, with a calendar-year cap of $2,190,294.
The original statutory amounts ran from $100 to $50,000 per violation, so budgeting against outdated figures understates the risk considerably.9Federal Register. Annual Civil Monetary Penalties Inflation Adjustment (2026)
FERPA for Student Records
Florida public schools and universities must also comply with the Family Educational Rights and Privacy Act.10Student Privacy Policy Office. 34 CFR Part 99 – Family Educational Rights and Privacy FERPA does not impose per-violation fines. Instead, the enforcement lever is the loss of federal funding, which makes it a high-stakes compliance obligation for any institution dependent on federal dollars.
What’s Changing
Two 2026 legislative proposals are worth tracking. Senate Bill 480 would transfer the Florida Digital Service’s duties, along with the state chief information officer position, to a new Division of Integrated Government Innovation and Technology (DIGIT). If enacted, DIGIT would become the enterprise organization responsible for IT governance, standards, strategy, and statewide reporting.11Florida Senate. Florida Senate Bill 480 – Information Technology
SPB 7024 would make several categories of agency cybersecurity information confidential and exempt from public records requests, including insurance coverage limits and deductibles for IT systems, critical infrastructure information, cybersecurity incident reports filed under Sections 282.318 and 282.3185, network diagrams, hardware and software configurations, encryption details, detection and response practices tied to suspected or confirmed breaches, sensitive portions of risk assessments and audit reports, and login credentials, IP addresses, and geolocation data from public-facing portals. Any portion of a public meeting that would reveal exempt information would be closed, though it would still have to be recorded and transcribed, with those recordings themselves kept confidential.12Florida Senate. SPB 7024 – Agency Cybersecurity Information
Neither proposal has become law. The current obligations under FIPA, the Digital Bill of Rights, and Chapter 282 remain the framework to plan against.