Data Breach Notification Statutes – Florida

Last Updated: 02/28/2024

• Applicable Statute: Fla. Stat. § 501.171
• Attorney General Notice Required: Yes, if a breach affects 500 or more residents, written notice must be given to the Department of Legal Affairs.
  • Timing: As expeditiously as practicable, but no more than 30 days. May receive an additional 15 days if good cause for delay is provided in writing to the Department within 30 days after determination of the breach.
  • Content: Notice must include:
    • A synopsis of the events surrounding the breach at the time notice is provided;
    • The number of individuals in this state who were or potentially have been affected by the breach;
    • Any services related to the breach being offered or scheduled to be offered, without charge, and instructions as to how to use such services;
    • A copy of the consumer notice required or an explanation of the other actions taken;
    • The name, address, telephone number, and email address of the employee or agent of the subject entity from whom additional information may be obtained about the breach.
• Consumer Notice Requirements:
  • Timing: As expeditiously as practicable and without unreasonable delay but no later than 30 days, taking into account the time necessary to allow a determination of the scope of the breach, to identify individuals affected, and to restore the reasonable integrity of the data system.
  • Content: The notification must include, at a minimum:
    • The date, estimated date, or estimated date range of the breach of security;
    • A description of the personal information that was accessed or reasonably believed to have been accessed; and
    • Information that the resident can use to contact the subject entity to inquire about the breach of security and the personal information that the subject entity maintained.
  • Method: Notice to an affected individual shall be by one of the following methods:
    • Written notice sent to the mailing address of the individual in the records of the subject entity;
    • Email notice sent to the email address of the individual in the records of the subject entity
• Consumer Reporting Agency Obligations: For a breach where more than 1,000 residents are notified, an entity must notify all nationwide consumer reporting agencies without unreasonable delay of the timing, content, and distribution of notice to consumers.