Wyoming Data Breach Notification Law

Wyoming's Data Breach Notification Law requires entities to notify residents when there is a breach involving their personal information. It also includes provisions for the secure destruction of records containing personal information.

JurisdictionWyoming
CategoryCybersecurity
StatusActive
Latest development

Analysis

Here is a comprehensive analysis of Wyoming's Data Breach Notification Law:

Key Requirements

  • Notification Requirement: Entities must notify Wyoming residents when there is a breach of personal information "in the most expedient time possible and without unreasonable delay" Wyoming Statutes § 40-12-502(a)
  • Personal Information Definition: Includes first name/initial and last name combined with:
  • Social Security number
  • Driver's license number
  • Account numbers with security/access codes
  • Medical information
  • Health insurance information
  • Biometric data

Wyoming Statutes § 40-12-501(a)(vii)

  • Risk of Harm Analysis: Notification is not required if the entity determines after investigation that misuse of personal information is unlikely Wyoming Statutes § 40-12-502(a)
  • Notification Content Requirements: Must include description of breach, types of information involved, actions taken to protect data, advice to remain vigilant Wyoming Statutes § 40-12-502(e)

Compliance Challenges

  • Meeting Notification Timelines: The "most expedient time possible" requirement can be challenging to interpret and comply with, especially for smaller organizations IAPP Privacy Advisor

Implementation Best Practices

Recent Updates

  • No significant recent updates to Wyoming's data breach law as of 2023

Related Regulations

  • State Data Protection Laws: Wyoming does not currently have a comprehensive data protection law like the CCPA, but organizations may need to comply with such laws in other states where they have customers IAPP US State Privacy Legislation Tracker

Industry Impact

Sources

Wyoming Statutes Title 40, Chapter 12, Article 5

Wyoming Attorney General Consumer Protection Unit

NIST Incident Response Guide

CIS Critical Security Controls

SANS Security Awareness Training

NIST Guidelines for Media Sanitization

Wyoming Legislature SF0035

HHS Breach Notification Rule

FTC Gramm-Leach-Bliley Act

IAPP US State Privacy Legislation Tracker

American Bankers Association Data Breach Toolkit

HIPAA Journal Wyoming Data Breach Laws

National Retail Federation Data Privacy

Ponemon Institute's Cost of a Data Breach Report

IAPP Privacy Advisor

Recent developments

  • — ComplianceIQ publishes a 2026 overview of Wyoming’s Data Breach Notification Law (Wyo. Stat. §§40-12-501 to 40-12-509), highlighting timing requirements (“most expedient time possible and without unreasonable delay”), harm‑based trigger (misuse occurred or likely), and enforcement under the Wyoming Consumer Protection Act with penalties up to $5,000 per violation.[5] (source)
  • — A 2024–2026 Wyoming privacy and accessibility laws update reiterates that Wyoming has no comprehensive privacy law but maintains a breach notification regime under Wyo. Stat. §§40‑12‑501 to 40‑12‑509, specifying up to 60‑day timing, AG notice when more than 250 residents are affected, and substitute notice thresholds, which practitioners continue to rely on for incident response planning.[7] (source)
  • — Insureon’s refreshed guidance for small businesses in Wyoming explains current breach notice obligations, including notice “in the most expedient time possible and without unreasonable delay,” permissible methods (written, electronic, substitute notice) and the Wyoming Attorney General’s exclusive enforcement authority, underscoring continuing regulatory expectations for cyber‑risk management.[2] (source)
  • — Davis Wright Tremaine updates its state data breach notification statute summary for Wyoming, detailing the harm‑threshold trigger, scope of covered entities, required content of consumer notices (incident description, date, remedial actions, credit‑monitoring advice, toll‑free contacts) and timing standard, which legal and compliance teams use to benchmark breach response practices.[1] (source)
  • — OneTrust DataGuidance’s Wyoming jurisdiction profile, updated for 2026, notes that while the state lacks a comprehensive data protection law, Article 5 of the Consumer Protection Act and credit freeze provisions impose breach notification duties for unauthorized acquisition of computerized data, reinforcing that breach rules remain the primary privacy mechanism and a focus of compliance programs.[4] (source)
  • — Caseguard’s analysis of Wyoming’s amended security breach law clarifies the definition of “data breach,” notice content requirements, and the expanded list of protected personal information (including health, biometric, and authentication data), highlighting operational impacts on incident investigations and documentation standards for organizations handling Wyoming residents’ data.[6] (source)
  • — Alston & Bird’s commentary on the July 1, 2015 amendments to Wyoming’s breach law describes the broadening of “personal identifying information” (e.g., medical, health insurance, biometric, authentication and online account data), a change that still shapes how organizations scope Wyoming reportable breaches and structure their data‑mapping and security controls today.[3] (source)
  • — The same Alston & Bird update notes new mandatory elements for notices to affected individuals (types of data, breach description and date, remedial actions, vigilance advice, and law‑enforcement delay disclosure), which industry has adopted as a template for Wyoming‑specific notification letters and consumer communications in breach events.[3] (source)
  • — Compliance and legal commentators reference Wyoming’s harm‑based trigger (misuse occurred or reasonably likely) and AG‑only enforcement model as relatively business‑friendly compared with strict liability regimes, influencing risk assessments, breach‑response playbooks, and decisions about voluntary over‑notification to maintain consumer trust and regulator goodwill.[5] (source)
  • — Industry privacy trackers note that, in the absence of a broad privacy statute, Wyoming’s breach notification law remains the principal driver of data‑security obligations, leading many general‑industry organizations to focus compliance investments on incident detection, breach investigations applying the harm standard, and scalable communication mechanisms to meet timing and AG‑notification thresholds.[7] (source)

Read the full guide to Wyoming Data Breach Notification Law

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates