← All US breach laws·WY

Wyoming data breach notification law

Wyoming's data breach notification requirements under Wyo. Stat. §§40-12-501 to 40-12-509. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Wyo. Stat. §§40-12-501 to 40-12-509
Enforcer
Wyoming Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay
Notify the state regulator
No general AG-notice requirement
Notify consumer reporting agencies
No specific CRA notification requirement

When is notification required?

Trigger / harm threshold
Notification required when misuse of PI has occurred or is reasonably likely to occur
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Wyoming law

First name/initial + last name with SSN, DL/state ID, financial account + access code, taxpayer ID, biometric data, health-insurance info, medical history, birth or marriage certificate, individually identifiable health info, shared secret/security token, OR username/email + password/security Q&A

Penalties and enforcement

Enforcement under Wyoming Consumer Protection Act — up to $5,000 per violation
Enforced by: Wyoming Attorney General. Official regulator page →

Common pitfalls

⚠ Wyoming's PI definition is among the broadest — includes birth/marriage certificates and shared secrets/security tokens

Frequently asked questions

How long do I have to notify Wyoming residents after a data breach?
In the most expedient time possible and without unreasonable delay
Do I have to notify the Wyoming Attorney General?
No general AG-notice requirement
Does Wyoming require notification to nationwide consumer reporting agencies?
No specific CRA notification requirement
Is encrypted data exempt from Wyoming's breach notification requirement?
Yes — Wyoming has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Wyoming residents sue me directly for a data breach?
No — Wyoming's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Wyoming law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, taxpayer ID, biometric data, health-insurance info, medical history, birth or marriage certificate, individually identifiable health info, shared secret/security token, OR username/email + password/security Q&A
What are the penalties for failing to comply with Wyoming's breach notification law?
Enforcement under Wyoming Consumer Protection Act — up to $5,000 per violation

Related state breach laws

West Virginia (WV)
W. Va. Code §§46A-2A-101 to 46A-2A-105
Wisconsin (WI)
Wis. Stat. §134.98

Pre-empt the Wyoming breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Wyoming's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit