1. Home
  2. State breach laws
  3. Florida

Florida data breach notification law

What Florida requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Fla. Stat. § 501.171.

30 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Florida runs one of the steepest penalty clocks in the country: $1,000 per day for the first 30 days late, then $50,000 for each additional 30-day period, up to $500,000 per breach. Residents must be notified within 30 days, and the Attorney General's office must hear within the same 30 days when 500 or more Floridians are affected. Florida filers are motivated buyers because the cost of getting the next incident wrong is spelled out in statute.

See recent Florida breach filings →

Requirements in detail

Statute
Fla. Stat. § 501.171
Deadline to notify residents
As quickly as practicable and without unreasonable delay, but no later than 30 days after the business determines a breach occurred or has reason to believe one occurred. The business can get 15 more days if it gives the Department of Legal Affairs good cause in writing within the 30 days, and law enforcement can request a delay in writing.
Attorney General notification
Yes, when 500 or more Florida residents are affected. Written notice must go to the Department of Legal Affairs (the Attorney General's office) as quickly as practicable and no later than 30 days after the breach is determined or reasonably suspected. Nationwide consumer reporting agencies must be notified when more than 1,000 people are notified at one time. Third-party vendors must notify the business within 10 days.
Penalties
Violations are treated as unfair or deceptive trade practices in actions brought by the Department of Legal Affairs. Failing to notify individuals or the department carries civil penalties of $1,000 per day for the first 30 days, then $50,000 for each additional 30-day period up to 180 days, and up to $500,000 if the violation lasts more than 180 days. Penalties apply per breach, not per affected person.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Florida's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Florida has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
Senate Bill 262 (Chapter 2023-201), effective July 1, 2024, added biometric data and geolocation information to the definition of personal information. Senate Bill 7026 (Chapter 2026-52) changed only the public-records confidentiality wording in subsection (11) and did not change any notice requirement.

Florida breach notification FAQ

What is the data breach notification deadline in Florida?

As quickly as practicable and without unreasonable delay, but no later than 30 days after the business determines a breach occurred or has reason to believe one occurred. The business can get 15 more days if it gives the Department of Legal Affairs good cause in writing within the 30 days, and law enforcement can request a delay in writing. The governing law is Fla. Stat. § 501.171.

Does Florida require notifying the Attorney General of a data breach?

Yes, when 500 or more Florida residents are affected. Written notice must go to the Department of Legal Affairs (the Attorney General's office) as quickly as practicable and no later than 30 days after the breach is determined or reasonably suspected. Nationwide consumer reporting agencies must be notified when more than 1,000 people are notified at one time. Third-party vendors must notify the business within 10 days.

What are the penalties for failing to report a data breach in Florida?

Violations are treated as unfair or deceptive trade practices in actions brought by the Department of Legal Affairs. Failing to notify individuals or the department carries civil penalties of $1,000 per day for the first 30 days, then $50,000 for each additional 30-day period up to 180 days, and up to $500,000 if the violation lasts more than 180 days. Penalties apply per breach, not per affected person.

Can individuals sue over a data breach in Florida?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Florida?

Florida's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Florida limit breach lawsuits for companies with a cybersecurity program?

No. Florida has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Florida Attorney General before relying on them.

Other states with a 30-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →