← All US breach laws·WI

Wisconsin data breach notification law

Wisconsin's data breach notification requirements under Wis. Stat. §134.98. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Wis. Stat. §134.98
Enforcer
Wisconsin Department of Agriculture, Trade and Consumer Protection + Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Within a reasonable time, not to exceed 45 days after the entity learns of the breach
Notify the state regulator
No general AG-notice requirement
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification not required if the acquisition does not create a material risk of identity theft or fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Wisconsin law

First name/initial + last name with SSN, DL/state ID, financial account + access code, DNA profile, unique biometric data

Penalties and enforcement

Enforcement under Consumer Protection laws — up to $10,000 per violation
Enforced by: Wisconsin Department of Agriculture, Trade and Consumer Protection + Attorney General. Official regulator page →

Common pitfalls

⚠ Wisconsin uniquely includes DNA profile as PI — relevant for healthcare, ancestry and biosciences

Frequently asked questions

How long do I have to notify Wisconsin residents after a data breach?
Within a reasonable time, not to exceed 45 days after the entity learns of the breach
Do I have to notify the Wisconsin Attorney General?
No general AG-notice requirement
Does Wisconsin require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Wisconsin's breach notification requirement?
Yes — Wisconsin has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Wisconsin residents sue me directly for a data breach?
No — Wisconsin's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Wisconsin law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, DNA profile, unique biometric data
What are the penalties for failing to comply with Wisconsin's breach notification law?
Enforcement under Consumer Protection laws — up to $10,000 per violation

Related state breach laws

Washington (WA)
Wash. Rev. Code §19.255.010
West Virginia (WV)
W. Va. Code §§46A-2A-101 to 46A-2A-105
Wyoming (WY)
Wyo. Stat. §§40-12-501 to 40-12-509

Pre-empt the Wisconsin breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Wisconsin's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit