← All US breach laws·ME

Maine data breach notification law

Maine's data breach notification requirements under 10 M.R.S.A. §§1346 to 1349. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
10 M.R.S.A. §§1346 to 1349
Enforcer
Maine Attorney General + Department of Professional and Financial Regulation
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
As expediently as possible and without unreasonable delay, but not later than 30 days after becoming aware of the breach and identifying its scope
Notify the state regulator
Yes — if any Maine residents are affected, written notice to the AG and the Department of Professional and Financial Regulation
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when PI has been or is reasonably believed to have been acquired by unauthorized persons — narrow misuse-required exceptions
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Maine law

First name/initial + last name with SSN, DL/state ID, financial account + access code, biometric data, OR username/email + password/security Q&A

Penalties and enforcement

Civil penalty up to $500 per violation, capped at $2,500 for related violations
Enforced by: Maine Attorney General + Department of Professional and Financial Regulation. Official regulator page →

Common pitfalls

⚠ Maine requires AG notice REGARDLESS of resident count — even a single Maine resident triggers AG filing
⚠ 30-day deadline starts when the breach is identified AND scoped — not when first reported

Frequently asked questions

How long do I have to notify Maine residents after a data breach?
As expediently as possible and without unreasonable delay, but not later than 30 days after becoming aware of the breach and identifying its scope
Do I have to notify the Maine Attorney General?
Yes — if any Maine residents are affected, written notice to the AG and the Department of Professional and Financial Regulation
Does Maine require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Maine's breach notification requirement?
Yes — Maine has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Maine residents sue me directly for a data breach?
No — Maine's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Maine law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, biometric data, OR username/email + password/security Q&A
What are the penalties for failing to comply with Maine's breach notification law?
Civil penalty up to $500 per violation, capped at $2,500 for related violations

Related state breach laws

Kentucky (KY)
Ky. Rev. Stat. §365.732
Louisiana (LA)
La. Rev. Stat. §§51:3071 to 51:3077
Maryland (MD)
Md. Code Com. Law §§14-3501 to 14-3508
Massachusetts (MA)
Mass. Gen. Laws ch. 93H §§1–6 + 201 CMR 17.00

Pre-empt the Maine breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Maine's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit