1. Home
  2. State breach laws
  3. Arkansas

Arkansas data breach notification law

What Arkansas requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ark. Code Ann. § 4-110-101 et seq. (Personal Information Protection Act); breach notice in § 4-110-105.

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Arkansas sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required once 1,000 or more residents are affected, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Arkansas breach filings →

Requirements in detail

Statute
Ark. Code Ann. § 4-110-101 et seq. (Personal Information Protection Act); breach notice in § 4-110-105
Deadline to notify residents
In the most expedient time and manner possible and without unreasonable delay, consistent with law enforcement needs and the steps needed to determine the scope of the breach. There is no fixed number of days for notifying individuals. Notice is not required if a reasonable investigation finds no reasonable likelihood of harm to customers.
Attorney General notification
Yes, if the breach affects more than 1,000 individuals. The Attorney General must be notified at the same time individuals are notified or within 45 days after the entity determines there is a reasonable likelihood of harm, whichever comes first. The statute does not require notice to consumer reporting agencies.
Penalties
Violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act. The breach statute itself does not set a dollar amount. Entities must keep their written breach determination for five years and give it to the Attorney General within 30 days of a request.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Arkansas's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Arkansas has no law limiting breach lawsuits for organizations that maintain a security program.

Arkansas breach notification FAQ

What is the data breach notification deadline in Arkansas?

In the most expedient time and manner possible and without unreasonable delay, consistent with law enforcement needs and the steps needed to determine the scope of the breach. There is no fixed number of days for notifying individuals. Notice is not required if a reasonable investigation finds no reasonable likelihood of harm to customers. The governing law is Ark. Code Ann. § 4-110-101 et seq. (Personal Information Protection Act); breach notice in § 4-110-105.

Does Arkansas require notifying the Attorney General of a data breach?

Yes, if the breach affects more than 1,000 individuals. The Attorney General must be notified at the same time individuals are notified or within 45 days after the entity determines there is a reasonable likelihood of harm, whichever comes first. The statute does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Arkansas?

Violations are enforced by the Attorney General under the Arkansas Deceptive Trade Practices Act. The breach statute itself does not set a dollar amount. Entities must keep their written breach determination for five years and give it to the Attorney General within 30 days of a request.

Can individuals sue over a data breach in Arkansas?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Arkansas?

Arkansas's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Arkansas limit breach lawsuits for companies with a cybersecurity program?

No. Arkansas has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Arkansas Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →