1. Home
  2. State breach laws
  3. Alaska

Alaska data breach notification law

What Alaska requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Alaska Stat. §§ 45.48.010–45.48.090 (Alaska Personal Information Protection Act).

No fixed deadline
Notification deadline
Not required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

Alaska sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so Alaska incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. Private-action exposure is limited, so the pressure is mostly regulatory and the pitch is about penalties, remediation, and not being on the list twice.

See recent Alaska breach filings →

Requirements in detail

Statute
Alaska Stat. §§ 45.48.010–45.48.090 (Alaska Personal Information Protection Act)
Deadline to notify residents
In the most expeditious time possible and without unreasonable delay after discovering or being notified of the breach. There is no fixed number of days, and notice can be delayed while a law enforcement agency says disclosure would interfere with a criminal investigation.
Attorney General notification
No, not for breaches that are reported to residents. The Attorney General must be notified in writing only when an entity decides, after investigating, that notice to residents is not required because harm is not reasonably likely. Nationwide consumer reporting agencies must be notified without unreasonable delay when more than 1,000 Alaska residents are notified.
Penalties
For businesses, a violation is an unfair or deceptive practice under Alaska's consumer protection law, with a civil penalty owed to the state of up to $500 for each resident who was not notified, capped at $50,000. Government agencies face the same $500-per-resident penalty and $50,000 cap, enforced by the Department of Administration, and can also be enjoined.
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
Alaska's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Alaska has no law limiting breach lawsuits for organizations that maintain a security program.

Alaska breach notification FAQ

What is the data breach notification deadline in Alaska?

In the most expeditious time possible and without unreasonable delay after discovering or being notified of the breach. There is no fixed number of days, and notice can be delayed while a law enforcement agency says disclosure would interfere with a criminal investigation. The governing law is Alaska Stat. §§ 45.48.010–45.48.090 (Alaska Personal Information Protection Act).

Does Alaska require notifying the Attorney General of a data breach?

No, not for breaches that are reported to residents. The Attorney General must be notified in writing only when an entity decides, after investigating, that notice to residents is not required because harm is not reasonably likely. Nationwide consumer reporting agencies must be notified without unreasonable delay when more than 1,000 Alaska residents are notified.

What are the penalties for failing to report a data breach in Alaska?

For businesses, a violation is an unfair or deceptive practice under Alaska's consumer protection law, with a civil penalty owed to the state of up to $500 for each resident who was not notified, capped at $50,000. Government agencies face the same $500-per-resident penalty and $50,000 cap, enforced by the Department of Administration, and can also be enjoined.

Can individuals sue over a data breach in Alaska?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in Alaska?

Alaska's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Alaska limit breach lawsuits for companies with a cybersecurity program?

No. Alaska has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Alaska Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →