Data Breach Notification Statutes – Illinois

Last Updated: 02/28/2024

• Applicable Statute: 815 ILCS 530/- Personal Information Protection Act.
• Attorney General Notice Required Yes if more than 500 Illinois residents are impacted.
  • Timing: Notice must be provided as expediently as possible and without unreasonable delay but in no event later than the date notice is provided to consumers.
  • Method: Email Databreach@ilag.gov
  • Content :
    • A description of the nature of the breach of security or unauthorized acquisition
    • the date of the breach
    • the number of Illinois residents affected by such incident at the time of notification, and
    • any steps the Entity has taken or plans to take relating to the incident.
    • If the date of the breach is unknown at the time the notice is sent to the Attorney General, the data collector shall send the Attorney General the date of the breach as soon as possible.
• Consumer Notice Requirements:
  • Timing: Most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the system.
  • Method: Written notice, or electronic notice if consistent with E-SIGN. If the breach involves usernames or email addresses, notice may be made by electronic or another form.
  • Content: The notice must include the toll-free numbers and addresses for consumer reporting agencies and the FTC, the website address for the FTC, and a statement that the individual can obtain information from these sources about fraud alerts and security freezes.
  • If the breach involves usernames or email addresses, notice should direct the individual to promptly change his or her username or password and security question or answer, or to take other steps appropriate to protect online accounts using the same login information.