Illinois data breach notification requirements come from PIPA, 815 ILCS 530, along with duties to secure and destroy records at foreign-owned and other businesses. An attorney decides whether an event is a breach. The overview page shows who PIPA covers.
What are the Illinois data breach notification requirements?
| Requirement | Plain meaning | Section |
|---|---|---|
| Tell residents | The owner or licensee notifies affected Illinois residents, free, without unreasonable delay and in the most expedient time possible; a written law enforcement request can delay notice | 10(a), (b-5) |
| Notice contents | Credit bureau and FTC details, or a prompt to change login credentials; no count of residents | 10(a) |
| Stored data | A party storing data belonging to another tells the owner immediately | 10(b) |
| Attorney General | More than 500 Illinois residents: notice no later than resident notice | 10(e)(2) |
| Security and disposal | Reasonable security, passed on by contract; records made unreadable | 45, 40 |
Key numbers and dates
| Item | Figure | Year |
|---|---|---|
| Attorney General notice | More than 500 residents | Since January 1, 2020 |
| Substitute notice | Cost over $250,000, over 500,000 people, or insufficient contact information | 2026 |
| Disposal penalty | Up to $100 per individual; $50,000 per instance | 2026 |
| Consumer Fraud Act | Civil penalty up to $50,000; $10,000 more per violation against a person 65 or older | 2026 |
Source: 815 ILCS 530/40 and 505/7
Recent and pending changes
PIPA took effect January 1, 2006, widened on January 1, 2017 and added Attorney General notice on January 1, 2020. We found no later amendment as of October 29, 2026.
The named checklist: the Ledger-Lock-and-Letter Review
Common practice, not a statutory duty.
- Ledger: list where Illinois residents' names sit beside the data items PIPA lists, such as payroll files.
- Ledger: note which items vendors hold, including abroad, and who owns or only stores them.
- Lock: check each vendor contract for a reasonable-security term.
- Lock: note how records are destroyed, after retention periods end.
- Letter: write down who sends resident notice and who tells the Attorney General above 500 residents.
- Letter: note who hears first of a vendor incident; repeat yearly.
Common mistakes
- Awaiting a full forensic report beyond the time needed to find the scope.
- Stating how many residents were affected.
- Forgetting Attorney General notice above 500 residents.
- Treating encrypted data as safe when the name or item is readable.
When to bring in an attorney
- A suspected breach, ransomware event or lost device carrying client or employee data.
- Notice across several states or regulators, or a law enforcement delay request.
- Vendor or cloud contracts moving data across borders, or any claim.
How we can help
We handle the U.S. tax, payroll and bookkeeping records that hold names, SSNs and bank details, alongside your attorney, Canadian CPA or Indian CA. See payroll and employer compliance and bookkeeping and accounting.
Frequently asked questions
How fast must Illinois businesses notify after a breach?
In the most expedient time possible, without unreasonable delay. There is no day count; the 45-day Attorney General deadline applies only to State agencies.
When must the Attorney General be told?
No later than resident notice, when a single breach means notifying more than 500 Illinois residents.
Does PIPA apply if our servers are in Canada or India?
It protects Illinois residents and looks at what an entity does with the data. Whether Illinois can enforce abroad is a legal question we did not research.
Can customers sue under PIPA?
PIPA has no private suit of its own. Violations count as unlawful practices under the Consumer Fraud Act, which allows suits for actual damage within 3 years.
Official sources
- Illinois General Assembly: Personal Information Protection Act, 815 ILCS 530
- Illinois General Assembly: Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505
- Illinois General Assembly: Public Act 101-0343
- Illinois General Assembly: SB 2897 bill status
- Illinois General Assembly: SB 3890 bill status
This page summarizes public guidance in plain language. If anything here differs from the official source, the official source controls.