1. Home
  2. State breach laws
  3. Illinois

Illinois data breach notification law

What Illinois requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by 815 ILCS 530/1 et seq. (Personal Information Protection Act).

No fixed deadline
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

Illinois has no fixed deadline for notice, but it has BIPA, the biometric privacy law with its own private right of action that has produced some of the largest privacy settlements anywhere. Any Illinois organization running fingerprint time clocks, facial-recognition access control, or biometric login that shows up in a breach filing has a second, larger problem. For MSPs that manage those systems, a breach filing is the opening to an audit of how biometric data is stored and retained.

See recent Illinois breach filings →

Requirements in detail

Statute
815 ILCS 530/1 et seq. (Personal Information Protection Act)
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering or being told of the breach, consistent with the steps needed to determine its scope and restore the system. There is no fixed number of days, and a written law enforcement request can delay notice.
Attorney General notification
Yes, when more than 500 Illinois residents are notified because of a single breach. Notice must be given in the most expedient time possible and no later than when consumers are notified. HIPAA-covered entities that comply with HIPAA must instead send the Attorney General any breach notice they file with the U.S. Department of Health and Human Services within 5 business days. State agencies must notify the Attorney General when more than 250 residents are affected, and must notify consumer reporting agencies when more than 1,000 people are notified. Private businesses have no consumer reporting agency notice requirement.
Penalties
A violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. The Attorney General or a State's Attorney may seek an injunction, restitution, and a civil penalty of up to $50,000. The penalty is up to $50,000 per violation when the court finds intent to defraud. An additional penalty of up to $10,000 per violation may apply when the victim is 65 or older.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
Illinois's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Illinois has no law limiting breach lawsuits for organizations that maintain a security program.

Illinois breach notification FAQ

What is the data breach notification deadline in Illinois?

In the most expedient time possible and without unreasonable delay after discovering or being told of the breach, consistent with the steps needed to determine its scope and restore the system. There is no fixed number of days, and a written law enforcement request can delay notice. The governing law is 815 ILCS 530/1 et seq. (Personal Information Protection Act).

Does Illinois require notifying the Attorney General of a data breach?

Yes, when more than 500 Illinois residents are notified because of a single breach. Notice must be given in the most expedient time possible and no later than when consumers are notified. HIPAA-covered entities that comply with HIPAA must instead send the Attorney General any breach notice they file with the U.S. Department of Health and Human Services within 5 business days. State agencies must notify the Attorney General when more than 250 residents are affected, and must notify consumer reporting agencies when more than 1,000 people are notified. Private businesses have no consumer reporting agency notice requirement.

What are the penalties for failing to report a data breach in Illinois?

A violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. The Attorney General or a State's Attorney may seek an injunction, restitution, and a civil penalty of up to $50,000. The penalty is up to $50,000 per violation when the court finds intent to defraud. An additional penalty of up to $10,000 per violation may apply when the victim is 65 or older.

Can individuals sue over a data breach in Illinois?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in Illinois?

Illinois's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Illinois limit breach lawsuits for companies with a cybersecurity program?

No. Illinois has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Illinois Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →