Louisiana Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Louisiana's Database Security Breach Notification Law requires businesses and government agencies that own or maintain computerized personal information to notify affected residents within 60 days of discovering a breach, under La. R.S. 51:3074. Separate written notice to the Attorney General must follow within 10 days of sending resident notifications.

Louisiana's Database Security Breach Notification Law requires any person or agency that owns, licenses, or maintains computerized personal information to notify affected Louisiana residents when that data is compromised. Originally enacted in 2005, the law was significantly strengthened in 2018 through Senate Bill 361, which added a hard 60-day notification deadline, expanded the definition of personal information to include biometric data and passport numbers, and created mandatory attorney general reporting obligations.

If your organization handles data belonging to Louisiana residents, understanding these requirements is not optional. The state treats every day of delayed AG notification as a separate violation with penalties up to $5,000.

For broader context on Louisiana's overall privacy framework, see the parent guide to Louisiana Data Privacy Laws.

What Triggers the Notification Requirement

Louisiana law defines a "breach of the security of the system" as the compromise of the security, confidentiality, or integrity of computerized data that results in, or where there is a reasonable likelihood to result in, the unauthorized acquisition of and access to personal information maintained by an agency or person. The "reasonable likelihood" prong is the part businesses most often miss. The duty can attach where unauthorized acquisition is reasonably likely, not only where it has been confirmed, so an entity cannot wait for proof that data was actually taken before deciding whether the statute applies.

There is one statutory exception: good faith acquisition of personal information by an employee or agent of the data holder does not count as a breach, as long as the information is not used for unauthorized purposes or subject to further unauthorized disclosure.

The law applies to three categories of entities under La. R.S. 51:3074:

• Any person that conducts business in Louisiana and owns or licenses computerized data containing personal information
• Any government agency that owns or licenses such data
• Any person or agency that maintains computerized data containing personal information that it does not own (these entities must notify the data owner or licensee)

What Counts as Protected Personal Information

Under La. R.S. 51:3073, "personal information" means an individual's first name or first initial and last name combined with any one or more of the following data elements:

• Social Security number
• Driver's license number or state identification card number
• Financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the account
• Passport number
• Biometric data, defined as data generated by automatic measurements of an individual's biological characteristics (such as fingerprints, voice print, eye retina or iris, or other unique biological characteristics) used to uniquely authenticate an individual's identity when accessing a system or account

The data element must not be encrypted or redacted to qualify. If the compromised data was encrypted at the time of the breach, the notification requirement does not apply. This is Louisiana's encryption safe harbor.

Publicly available information from federal, state, or local government records is excluded from the definition of personal information.

The 60-Day Notification Timeline

Notification must be made "in the most expedient time possible and without unreasonable delay" but no later than 60 days from the date the breach is discovered. This hard deadline was added by the 2018 SB 361 amendments and replaced the prior open-ended "most expedient time possible" standard.

The 60-day clock starts on the date of discovery, not the date the breach actually occurred. Discovery means the point when the entity becomes aware that a breach has happened.

Permitted Delays

Two circumstances allow the notification period to extend beyond 60 days:

Law enforcement delay. If a law enforcement agency determines that notification would impede a criminal investigation, the notification may be delayed until law enforcement determines it will no longer compromise the investigation.

Scope and remediation delay. If the entity determines that additional time is needed to determine the scope of the breach, prevent further disclosures, or restore the reasonable integrity of the data system, it may delay notification. However, the entity must provide the Attorney General written reasons for the delay within the original 60-day period. The AG then grants a reasonable extension.

In both cases, the entity must still provide written justification to the AG within 60 days. There is no blanket exception that allows indefinite delay.

Attorney General Notification Requirements

Louisiana imposes separate, mandatory notification to the Attorney General's office. Under Louisiana Administrative Code Title 16, Part III, Section 701, entities must:

• Send written notice to the AG's Consumer Protection Section within 10 days of distributing breach notices to Louisiana residents
• Include the names of all Louisiana citizens affected by the breach in the notification
• Submit the notification to the Consumer Protection Section at the Louisiana Department of Justice

Notice can be filed through the LA Database Security Breach Online Reporting Form or mailed to:

Louisiana Department of Justice Office of the Attorney General Consumer Protection Section 1885 N. Third Street Baton Rouge, LA 70802

Failure to provide timely AG notification carries fines up to $5,000 per violation, with each day of late notice counting as a separate violation.

Methods of Notification to Individuals

Louisiana allows three methods of notifying affected individuals under La. R.S. 51:3074(G):

Written notification. A physical letter sent to the affected individual.

Electronic notification. Email notification, provided it complies with the federal E-SIGN Act (15 U.S.C. 7001).

Substitute notification. Available when the cost of direct notification would exceed $100,000, the affected class exceeds 100,000 people, or the entity lacks sufficient contact information. Substitute notification requires all three of the following:

• Email notification to individuals for whom the entity has email addresses
• Conspicuous posting on the entity's website
• Notification to major statewide media outlets

Entities that already maintain a notification procedure as part of their information security policy may use that procedure instead, provided it is consistent with the statute's timing requirements.

Harm-Based Exemption

Notification is not required if, after a reasonable investigation, the entity determines there is no reasonable likelihood of harm to Louisiana residents from the breach.

This exemption comes with documentation requirements. The entity must retain a written copy of its determination and supporting documentation for five years from the date of discovery. If the Attorney General requests this documentation in writing, the entity must provide it within 30 days.

Security Requirements

Beyond notification, Louisiana law imposes affirmative data security obligations. Under La. R.S. 51:3074(A), any entity that conducts business in Louisiana or owns or licenses computerized personal information must implement and maintain "reasonable security procedures and practices appropriate to the nature of the information" to protect personal information from unauthorized access, destruction, use, modification, or disclosure.

The law also requires entities to take "all reasonable steps" to destroy records containing personal information that are no longer needed. Acceptable destruction methods include shredding, erasing, or otherwise making the information unreadable and undecipherable.

Enforcement and Penalties

Violations of the Database Security Breach Notification Law constitute unfair acts or practices under Louisiana's Unfair Trade Practices and Consumer Protection Law (La. R.S. 51:1405). This means the Attorney General can bring enforcement actions using the full range of consumer protection remedies.

For AG notification failures specifically, fines can reach $5,000 per violation per day.

Under La. R.S. 51:3075, individuals may also bring a civil action to recover actual damages resulting from the failure to provide timely breach notification. However, Louisiana does not provide a broad private right of action for the breach itself. The private cause of action is limited to damages caused by the failure to notify, not by the breach.

Notable Legislative History

Louisiana's breach notification law has been amended several times since its 2005 enactment:

Act 499 (2005). Established the original Database Security Breach Notification Law, effective January 1, 2006. Required notification in the "most expedient time possible" with no hard deadline.

Act 382 / SB 361 (2018). The most significant overhaul. Added the 60-day notification deadline, expanded personal information to include biometric data and passport numbers, created the harm-based exemption with five-year documentation retention, required written justification to the AG for delayed notifications, and added the reasonable security procedures requirement.

The Louisiana Data Privacy Act (SB 386, Act 502 of 2026)

Louisiana enacted a comprehensive data privacy law when Governor Landry signed Senate Bill 386, sponsored by Senator Connick, as Act 502 on May 29, 2026. The Act enacts Chapter 20-B of Title 51, comprised of La. R.S. 51:1780.1 through 1780.5. It takes effect January 1, 2027, and creates broader consumer privacy rights beyond breach notification.

Key provisions of the enacted law include:

• Applies to a person or entity that does business in Louisiana and meets at least one of three thresholds under R.S. 51:1780.2(A): annual gross revenues over $25 million; annually buying, receiving for commercial purposes, selling, or sharing the personal information of 75,000 or more consumers, households, or devices; or deriving 50 percent or more of annual revenues from selling consumers' personal information
• Prohibits the sale of sensitive personal data without prior consumer consent
• Gives enforcement authority to the Attorney General under R.S. 51:1780.5(A), with a notice-and-cure window that is transitional rather than permanent: it applies only from January 1, 2027 through July 31, 2027 (R.S. 51:1780.5(D))
• Makes any violation an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law, R.S. 51:1401 et seq., excluding the private rights of action provided in R.S. 51:1409 and 1409.1 (R.S. 51:1780.5(C)). The Act sets no separate per-violation penalty amount of its own
• Exempts state agencies, financial institutions, nonprofits, higher education institutions, and entities already governed by HIPAA or GLBA

With Act 502 signed, Louisiana became the 22nd state to adopt a comprehensive consumer privacy framework, complementing the existing breach notification requirements. Enforcement belongs to the Attorney General, who pursues violations through the Unfair Trade Practices and Consumer Protection Law while the Act expressly excludes the private rights of action in R.S. 51:1409 and 1409.1. The 30-day notice-and-cure opportunity is not a standing feature of the law. By its own terms it runs only from January 1, 2027 through July 31, 2027, after which the Attorney General may investigate without first offering a chance to cure.

This article provides general legal information about Louisiana data breach notification laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Louisiana for advice about your specific situation.

More Louisiana Laws

• Louisiana Deepfake Laws
• Louisiana Employee Monitoring Laws
• Louisiana GPS Tracking Laws
• Louisiana Recording Laws

Frequently Asked Questions

How quickly must a business notify Louisiana residents of a data breach?

Louisiana law requires notification in the most expedient time possible and no later than 60 days from the date the breach is discovered. If a law enforcement investigation or the need to determine the breach scope requires additional time, the entity must provide written reasons to the Attorney General within the 60-day window. The AG can then grant a reasonable extension.

Does Louisiana require notification to the Attorney General after a data breach?

Yes. Entities must send written notice to the Attorney General's Consumer Protection Section within 10 days of distributing notices to affected Louisiana residents. The notice must include the names of all affected Louisiana citizens. Late AG notification carries fines up to $5,000 per violation, with each day of delay counted separately.

Is encrypted data exempt from Louisiana's breach notification requirements?

Yes. Louisiana's law only applies to personal information that is not encrypted or redacted. If the compromised data was properly encrypted at the time of the breach, the notification requirement does not apply. This encryption safe harbor is one of the most straightforward ways for businesses to limit their breach notification obligations.

Can individuals sue for a data breach in Louisiana?

Individuals can file a civil action under La. R.S. 51:3075 to recover actual damages caused by the failure to provide timely breach notification. However, there is no broad private right of action for the breach itself. The lawsuit must be based on the entity's failure to notify, not on the unauthorized access to data. The Attorney General handles broader enforcement under the Unfair Trade Practices Act.

Does Louisiana's breach notification law cover biometric data?

Yes, since the 2018 amendments through SB 361. Louisiana defines biometric data as information generated by automatic measurements of biological characteristics, such as fingerprints, voice prints, and eye retina or iris scans, used to authenticate an individual's identity when accessing a system or account. If biometric data combined with a person's name is compromised in a breach, the notification requirements apply.