← All US breach laws·MI

Michigan data breach notification law

Michigan's data breach notification requirements under Mich. Comp. Laws §§445.63, 445.72 (Identity Theft Protection Act). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Mich. Comp. Laws §§445.63
Enforcer
Michigan Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
No specific AG-notice requirement for businesses
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when the breach has caused, or is likely to cause, substantial loss or injury to, or identity theft of, a Michigan resident
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Michigan law

First name/initial + last name with SSN, DL/state ID, account number + access code

Penalties and enforcement

Civil penalty up to $250 per failure (capped at $750,000 per breach) — among the heaviest aggregate caps
Enforced by: Michigan Attorney General. Official regulator page →

Common pitfalls

⚠ Michigan's $750,000 aggregate cap and per-failure structure makes large consumer-facing breaches especially costly

Frequently asked questions

How long do I have to notify Michigan residents after a data breach?
Without unreasonable delay
Do I have to notify the Michigan Attorney General?
No specific AG-notice requirement for businesses
Does Michigan require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Michigan's breach notification requirement?
Yes — Michigan has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Michigan residents sue me directly for a data breach?
No — Michigan's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Michigan law?
First name/initial + last name with SSN, DL/state ID, account number + access code
What are the penalties for failing to comply with Michigan's breach notification law?
Civil penalty up to $250 per failure (capped at $750,000 per breach) — among the heaviest aggregate caps

Related state breach laws

Maryland (MD)
Md. Code Com. Law §§14-3501 to 14-3508
Massachusetts (MA)
Mass. Gen. Laws ch. 93H §§1–6 + 201 CMR 17.00
Minnesota (MN)
Minn. Stat. §§325E.61
Mississippi (MS)
Miss. Code §75-24-29

Pre-empt the Michigan breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Michigan's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit