Louisiana Database Security Breach Notification Law

Louisiana's Database Security Breach Notification Law requires entities to notify residents in the event of a data breach involving personal information. It also mandates data destruction practices.

JurisdictionLouisiana
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

The Louisiana Database Security Breach Notification Law imposes several key requirements on entities that own, license, or maintain personal information of Louisiana residents:

  • Notification of affected individuals: Entities must notify Louisiana residents whose personal information was or is reasonably believed to have been acquired by an unauthorized person due to a data breach within 60 days of discovering the breach.

Compliance Challenges

Organizations face several challenges in complying with this law:

  • Determining breach scope: Identifying all affected individuals within the 60-day notification window can be difficult, especially for large-scale breaches. A 2021 IBM study found that it takes an average of 287 days to identify and contain a data breach.
  • Maintaining "reasonable" security: The law's requirement for "reasonable" security measures is vague, leaving organizations uncertain about compliance. A 2022 Ponemon Institute report found that 67% of organizations struggle to determine what constitutes "reasonable" security.
  • Data inventory and classification: Many organizations struggle to maintain an accurate inventory of personal data, making it challenging to ensure proper protection and destruction. A 2023 ISACA survey found that 43% of organizations lack a complete data inventory.

Implementation Best Practices

To effectively implement the law's requirements:

  • Implement data mapping: Regularly inventory and classify personal data to ensure proper protection and timely destruction. Tools like OneTrust's Data Inventory & Mapping can assist with this process.
  • Conduct regular security assessments: Perform periodic vulnerability scans and penetration tests to identify and address security weaknesses. The OWASP Testing Guide offers guidance on conducting security assessments.

Recent Updates

The most significant recent update to the law occurred in 2018:

  • Act 382 (effective August 1, 2018): This amendment expanded the definition of personal information to include passport numbers and biometric data. It also introduced the 60-day notification deadline and lowered thresholds for substitute notice methods.

Related Regulations

Several related regulations interact with Louisiana's law:

  • HIPAA: For healthcare entities, HIPAA's Breach Notification Rule may apply in addition to Louisiana's law, requiring notification within 60 days for breaches affecting 500 or more individuals.
  • Gramm-Leach-Bliley Act (GLBA): Financial institutions must comply with both Louisiana's law and the GLBA's Safeguards Rule, which requires comprehensive information security programs.
  • California Consumer Privacy Act (CCPA): Organizations doing business in both Louisiana and California may need to comply with the CCPA's more stringent requirements, including a 30-day breach notification deadline.

Industry Impact

The law has had significant impacts across various industries:

  • Healthcare: The healthcare sector, already subject to HIPAA, faces additional compliance burdens. A 2022 HIMSS survey found that 66% of healthcare organizations experienced a significant security incident in the past 12 months, highlighting the importance of robust breach notification processes.
  • Financial Services: Banks and credit unions must integrate Louisiana's requirements with existing federal regulations. The American Bankers Association provides guidance on navigating these overlapping requirements.

Sources

Recent developments

  • — Louisiana Attorney General’s office reiterates that businesses and agencies experiencing a breach involving Louisiana residents must notify affected individuals “in the most expedient time possible and without unreasonable delay, but not later than sixty days from the discovery of the breach,” and must notify the AG within 10 days after consumer notices are sent, underscoring ongoing enforcement of the Database Security Breach Notification Law.[8][6] (source)
  • — Industry guidance for small businesses highlights Louisiana’s strict 60‑day outside deadline for notifying residents after discovery of a breach, the 10‑day deadline to notify the AG after resident notice, and potential civil penalties up to $5,000 per violation (capped at $500,000), reinforcing that noncompliance with the Database Security Breach Notification Law carries significant financial risk.[5] (source)
  • — A detailed legal explainer summarizes current obligations under Louisiana’s Database Security Breach Notification Law, including duties to safeguard and properly destroy personal information, notify residents within 60 days unless there is no reasonable likelihood of harm, and maintain written determinations of “no harm” for five years, shaping how companies design incident‑response and retention policies.[2][6] (source)
  • — The consolidated statutory text of Louisiana Revised Statute 51:3074, the core Database Security Breach Notification Law, is updated on the legislature’s portal, reaffirming definitions of “personal information,” the 60‑day notification deadline, allowed substitute notice methods, and the investigation‑based exception where no notification is required if there is no reasonable likelihood of harm.[6][1] (source)
  • — Tulane University’s updated compliance page on the Louisiana Security Breach Notification Law advises institutional units handling student and employee data that any breach of unencrypted personal information must trigger prompt notification to affected Louisiana residents, emphasizing alignment of university incident‑response playbooks with state timelines and requirements.[4][6] (source)
  • — A law‑firm update, recently recirculated in client alerts, underscores that Louisiana’s strengthened breach‑notification regime requires notice within 60 days of discovery and that failure to timely notify the Attorney General can result in fines of up to $5,000 per violation per day, prompting companies to reassess breach‑response procedures and escalation workflows.[3][5] (source)
  • — Cyber‑insurance advisors stress that under Louisiana’s data breach notification framework, businesses must be prepared to provide written or electronic notices, potentially use substitute notice if costs or affected individuals exceed statutory thresholds, and coordinate with the AG, influencing how policies are underwritten and how insureds document their incident‑response capabilities.[5][6] (source)
  • — Compliance commentators reiterate that Louisiana’s law applies broadly to any entity doing business in the state or maintaining data on residents, and that intentional violations can expose organizations to treble damages in private actions, reinforcing industry concerns about litigation exposure following security incidents.[2] (source)
  • — Louisiana’s Insurance Data Security Law (RS 22:2501 et seq.) is highlighted as complementary to the general Database Security Breach Notification Law, requiring insurance licensees to report “cybersecurity events” with detailed incident information to the insurance commissioner, leading insurers and agents to tighten internal cybersecurity controls and reporting practices.[7] (source)
  • — The Louisiana Attorney General’s breach‑reporting portal continues to direct businesses and agencies to submit breach notifications and affected‑resident lists electronically, signaling the AG’s ongoing focus on centralized intake and monitoring of incidents under the Database Security Breach Notification Law and influencing how organizations structure their notification workflows.[8][5] (source)

Read the full guide to Louisiana Database Security Breach Notification Law

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates