The Illinois Personal Information Protection Act, called PIPA (815 ILCS 530), is Illinois's law on data breaches and data security. It asks any business holding certain personal details about Illinois residents to keep reasonable security, destroy records safely and notify people after a breach. The Illinois Attorney General is the main enforcer. It is not a general privacy-rights law. This page is for owners of Illinois or foreign-owned businesses, including those whose customer or payroll data sits with vendors in Canada or India.
What does the Illinois Personal Information Protection Act cover?
| Question | Answer |
|---|---|
| Who is covered | Any entity that handles or deals with nonpublic personal information, including corporations, retailers and universities |
| Personal information, type 1 | First name or initial plus last name with a state ID or driver's license number, account or card number, a Social Security number, or medical, health insurance or unique biometric data |
| Personal information, type 2 | A user name or email address together with a password or a security question and answer that could open an online account |
| Encryption | A name or item left readable still counts. Where both are encrypted or redacted, it counts only if the keys were also taken |
| Special regimes | HIPAA entities complying with HIPAA are deemed compliant, with Attorney General notice if they must tell HHS; GLBA status can change duties (see the GLBA and HIPAA page) |
What does it mean for a foreign-owned or cross-border business?
| Situation | What the law says | What to check |
|---|---|---|
| Illinois customers or staff, owner in Canada or India | The Act protects Illinois residents and looks at what an entity does with the data | Whether Illinois can enforce against an entity or vendor abroad is a legal question we did not research |
| Vendor in Canada or India stores your data | The security duty covers owners and storers. A storer must tell the owner immediately after a breach. A contract disclosing data must require reasonable security | The vendor contract |
| Payroll and owner records | SSNs and bank account numbers are listed items | Who holds them (employer checklist) |
| Old records | Disposal must leave records unreadable; the IRS says to keep employment tax records for at least 4 years | Dispose after retention ends (record retention) |
Canadian and Indian privacy rules are outside this page. The rules and checklist page has the requirements, numbers and the Ledger-Lock-and-Letter Review. For related penalties, see the Consumer Fraud Act page.
Official sources
- Illinois General Assembly: Personal Information Protection Act, 815 ILCS 530
- Illinois General Assembly: Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505
- Illinois Attorney General: Data breach information for businesses
- IRS: Employment tax recordkeeping
This page summarizes public guidance in plain language. If anything here differs from the official source, the official source controls.