Louisiana Data Breach Notification Law: Deadlines, Duties, and Penalties

Under the Louisiana data breach notification law (La. R.S. 51:3071 et seq.), any business or government agency that owns, licenses, or maintains computerized personal information about Louisiana residents must notify those residents of a security breach as quickly as possible, and no later than 60 days after discovering it.¹ Miss the deadline and you face enforcement by the Attorney General, civil penalties of up to $5,000 per violation, and private lawsuits from the people you failed to notify.

Who Has to Comply

The law reaches further than many businesses expect. If you conduct business in Louisiana and hold computerized data containing personal information about Louisiana residents, you are covered. Government agencies holding the same data have identical obligations.¹ Being headquartered out of state doesn’t matter. A company based anywhere that stores personal data on Louisiana residents still falls under the statute.

What Data Triggers the Law

Not every leak counts as a reportable breach. The statute protects a specific combination: a Louisiana resident’s first name (or first initial) and last name paired with at least one of the following, as long as neither element is encrypted or redacted:²

Social Security number
Driver’s license or state ID number
Financial account number, credit card, or debit card number together with any security code, access code, or password that would allow access to the account
Passport number
Biometric data such as fingerprints, voiceprints, or retina or iris scans used to authenticate identity

Information already publicly available through federal, state, or local government records is excluded from the definition.² A name exposed alongside a public property record, for instance, does not trigger notification.

A “breach of security” is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of that personal information. Once you discover a breach, or reasonably believe one has occurred, your 60-day clock starts.¹

The 60-Day Deadline and How to Deliver Notice

Notification must go out as soon as reasonably possible, and in no case later than 60 days after discovery.¹ That window is meant to absorb time spent investigating scope, stopping ongoing exposure, and restoring systems. It is a ceiling, not breathing room. Businesses often treat 60 days as a soft target, and the investigation runs past it.

Standard Notice

Two delivery methods are permitted: written notice sent to the affected individual, or electronic notice that complies with the federal Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001).³ A phone call does not qualify.

Substitute Notice

Substitute notification is available only when direct notice is impractical: the cost would exceed $100,000, more than 100,000 people are affected, or you lack sufficient contact information. It is not a menu. You must do all three of the following:³

Email every affected person for whom you have an email address.
Post a conspicuous notice on your website, if you have one.
Notify major statewide media outlets.

Skip any one of the three and the substitute notice is incomplete. A website posting alone, without the media piece, leaves you non-compliant.

When You Can Skip or Delay Notice

Two exceptions can relieve the obligation to notify, and one circumstance can pause the clock.

The first exception is encryption or redaction. The definition of personal information excludes data that was encrypted or redacted at the time of the breach, so a breach of properly encrypted records does not meet the statutory trigger.² This protection evaporates if the encryption key was also compromised.

The second is a no-harm determination. If, after a reasonable investigation, you conclude there is no reasonable likelihood of harm to affected residents, you don’t have to notify. But this cannot be an informal judgment call. You must document the determination in writing, keep the documentation and supporting analysis for five years from the date of discovery, and produce it within 30 days if the Attorney General asks for it.³ A thin after-the-fact memo will not survive scrutiny.

Notification can also be delayed when a law enforcement agency determines that giving notice would interfere with a criminal investigation. The delay runs until law enforcement confirms that notification will no longer compromise the case.¹ A law enforcement hold pauses your duty to notify residents, but it does not pause your duty to keep the Attorney General informed.

What You Owe the Attorney General

If you need any delay past 60 days, whether at law enforcement’s request or because you need more investigation time, you must give the Attorney General a written explanation inside the original 60-day window. The Attorney General has discretion to grant a reasonable extension.³ And if you’ve decided no notification is needed, be ready to turn over your written risk analysis within 30 days of a request.

If You Hold Someone Else’s Data

Vendors, cloud hosts, payroll processors, and IT providers that maintain personal information they do not own have a separate duty. On discovering or reasonably believing a breach has exposed that data, the processor must notify the data owner or licensee.¹ The duty to notify affected individuals stays with the owner, but a slow vendor can easily push the owner past the 60-day deadline.

Security and Record Disposal Duties

The statute isn’t only reactive. Any business operating in Louisiana or holding personal information about Louisiana residents must implement and maintain reasonable security measures appropriate to the nature of the data, protecting it from unauthorized access, destruction, use, modification, and disclosure.¹ The law does not spell out specific technical standards.

When you no longer need records containing personal information, you must destroy them by shredding, erasing, or otherwise making the data unreadable.³ Deleting a file or tossing a drive in the trash does not meet the standard.

Penalties and Private Lawsuits

A violation of the notification law is treated as an unfair trade practice under La. R.S. 51:1405(A), which puts enforcement in the Attorney General’s hands.³ Civil penalties can reach $5,000 per violation, and each failure to notify an individual counts as a separate violation. A breach affecting 10,000 people could theoretically expose a business to $50 million. Treble damages are available where the violation was knowing and the business had been warned by the Attorney General.

Residents have their own path. Under La. R.S. 51:3075, any person can file a civil lawsuit to recover actual damages caused by a business’s failure to provide timely breach notification. Large breaches raise a real class-action risk alongside state enforcement.

Federal Rules Don’t Replace This One

If you’re in a regulated industry, federal law adds requirements rather than substituting for state ones. Healthcare organizations covered by HIPAA must follow the federal Breach Notification Rule (45 CFR §§ 164.400–414) for breaches of unsecured protected health information, which has its own timelines, content rules, and mandatory reporting to the Department of Health and Human Services.⁴ Complying with HIPAA does not satisfy Louisiana.

Financial institutions subject to the Gramm-Leach-Bliley Act face their own data protection and customer notification framework, including the FTC Safeguards Rule’s information security program requirement.⁵ GLBA compliance does not exempt you from the state statute either. A single breach can draw enforcement from state and federal regulators at the same time, and covered entities need parallel compliance programs addressing both.

1
Justia Law. Louisiana Revised Statutes 51-3074 – Protection of Personal Information; Disclosure Upon Breach in the Security of Personal Information; Notification Requirements; Exemption
2
Louisiana State Legislature. Louisiana Code 51-3073 – Definitions
3
Louisiana State Legislature. Louisiana Code 51-3074 – Protection of Personal Information; Disclosure Upon Breach in the Security of Personal Information; Notification Requirements; Exemption
4
U.S. Department of Health and Human Services. Breach Notification Rule
5
Federal Trade Commission. Gramm-Leach-Bliley Act