← All US breach laws·LA

Louisiana data breach notification law

Louisiana's data breach notification requirements under La. Rev. Stat. §§51:3071 to 51:3077 (Database Security Breach Notification Law). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
La. Rev. Stat. §§51:3071 to 51:3077
Enforcer
Louisiana Attorney General
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay, but no later than 60 days
Notify the state regulator
Yes — written notice to the Louisiana AG within 10 days of distribution of notice to Louisiana residents
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification not required if, after reasonable investigation, no reasonable likelihood of harm exists
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Louisiana law

First name/initial + last name with SSN, DL/state ID, account/credit/debit + access code, passport number, biometric data

Penalties and enforcement

Civil enforcement by AG; private right of action for actual damages and equitable relief
Enforced by: Louisiana Attorney General. Official regulator page →

Common pitfalls

⚠ Louisiana's 10-day AG-after-notice rule trips up companies that file AG notice first then notify — the order is residents first
⚠ Private right of action means consumer class actions possible

Frequently asked questions

How long do I have to notify Louisiana residents after a data breach?
In the most expedient time possible and without unreasonable delay, but no later than 60 days
Do I have to notify the Louisiana Attorney General?
Yes — written notice to the Louisiana AG within 10 days of distribution of notice to Louisiana residents
Does Louisiana require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Louisiana's breach notification requirement?
Yes — Louisiana has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Louisiana residents sue me directly for a data breach?
Yes — Louisiana allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Louisiana law?
First name/initial + last name with SSN, DL/state ID, account/credit/debit + access code, passport number, biometric data
What are the penalties for failing to comply with Louisiana's breach notification law?
Civil enforcement by AG; private right of action for actual damages and equitable relief

Related state breach laws

Kansas (KS)
Kan. Stat. §50-7a02
Kentucky (KY)
Ky. Rev. Stat. §365.732
Maine (ME)
10 M.R.S.A. §§1346 to 1349
Maryland (MD)
Md. Code Com. Law §§14-3501 to 14-3508

Pre-empt the Louisiana breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Louisiana's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit