← All US breach laws·AK

Alaska data breach notification law

Alaska's data breach notification requirements under Alaska Stat. §§45.48.010–45.48.090 (Personal Information Protection Act). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Alaska Stat. §§45.48.010–45.48.090
Enforcer
Alaska Department of Law — Consumer Protection
AG notification
Not required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay
Notify the state regulator
No statutory requirement to notify the AG, but the AG may bring enforcement actions under the Alaska Unfair Trade Practices Act
Notify consumer reporting agencies
Yes — if more than 1,000 Alaska residents, notify nationwide consumer reporting agencies

When is notification required?

Trigger / harm threshold
Notification not required if, after appropriate investigation and written notice to the AG, there is no reasonable likelihood of harm
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Alaska law

First name/initial + last name with SSN, DL/state ID, account number + access code, or password to a financial account

Penalties and enforcement

Civil penalty up to $500 per resident not notified, capped at $50,000; injunctive relief; private right of action for actual damages
Enforced by: Alaska Department of Law — Consumer Protection. Official regulator page →

Common pitfalls

⚠ The 'no harm' exception requires WRITTEN notice to the AG documenting the analysis — verbal/internal-memo only is insufficient
⚠ Private right of action makes Alaska one of the more litigation-prone states; preserve evidence of timely investigation

Frequently asked questions

How long do I have to notify Alaska residents after a data breach?
In the most expedient time possible and without unreasonable delay
Do I have to notify the Alaska Attorney General?
No statutory requirement to notify the AG, but the AG may bring enforcement actions under the Alaska Unfair Trade Practices Act
Does Alaska require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 Alaska residents, notify nationwide consumer reporting agencies
Is encrypted data exempt from Alaska's breach notification requirement?
Yes — Alaska has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Alaska residents sue me directly for a data breach?
Yes — Alaska allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Alaska law?
First name/initial + last name with SSN, DL/state ID, account number + access code, or password to a financial account
What are the penalties for failing to comply with Alaska's breach notification law?
Civil penalty up to $500 per resident not notified, capped at $50,000; injunctive relief; private right of action for actual damages

Related state breach laws

Alabama (AL)
Ala. Code §§8-38-1 to 8-38-12
Arizona (AZ)
Ariz. Rev. Stat. §18-552
Arkansas (AR)
Ark. Code §§4-110-101 to 4-110-108

Pre-empt the Alaska breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Alaska's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit