1. Home
  2. State breach laws
  3. Louisiana

Louisiana data breach notification law

What Louisiana requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by La. Rev. Stat. §§ 51:3071–51:3077; La. Admin. Code tit. 16, pt. III, § 701.

60 days
Notification deadline
Required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

Louisiana's 60-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. Private-action exposure is limited, so the pressure is mostly regulatory and the pitch is about penalties, remediation, and not being on the list twice.

See recent Louisiana breach filings →

Requirements in detail

Statute
La. Rev. Stat. §§ 51:3071–51:3077; La. Admin. Code tit. 16, pt. III, § 701
Deadline to notify residents
In the most expedient time possible and without unreasonable delay, but no later than 60 days after discovering the breach. If notice is delayed for law enforcement or to determine scope and restore the system, the business must give the Attorney General written reasons within the 60-day period, and the Attorney General will allow a reasonable extension.
Attorney General notification
Yes. Whenever Louisiana residents must be notified, written notice must reach the Attorney General's Consumer Protection Section within 10 days after notices go to residents, and it must include the names of all affected Louisiana residents. Louisiana's law does not require notice to consumer reporting agencies.
Penalties
Failing to notify the Attorney General on time can bring a fine of up to $5,000 per violation, and each day the notice is late counts as a separate violation. Any violation of the breach law is also an unfair act or practice under the Louisiana Unfair Trade Practices Act (La. Rev. Stat. § 51:1405).
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
Louisiana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Louisiana has no law limiting breach lawsuits for organizations that maintain a security program.

Louisiana breach notification FAQ

What is the data breach notification deadline in Louisiana?

In the most expedient time possible and without unreasonable delay, but no later than 60 days after discovering the breach. If notice is delayed for law enforcement or to determine scope and restore the system, the business must give the Attorney General written reasons within the 60-day period, and the Attorney General will allow a reasonable extension. The governing law is La. Rev. Stat. §§ 51:3071–51:3077; La. Admin. Code tit. 16, pt. III, § 701.

Does Louisiana require notifying the Attorney General of a data breach?

Yes. Whenever Louisiana residents must be notified, written notice must reach the Attorney General's Consumer Protection Section within 10 days after notices go to residents, and it must include the names of all affected Louisiana residents. Louisiana's law does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Louisiana?

Failing to notify the Attorney General on time can bring a fine of up to $5,000 per violation, and each day the notice is late counts as a separate violation. Any violation of the breach law is also an unfair act or practice under the Louisiana Unfair Trade Practices Act (La. Rev. Stat. § 51:1405).

Can individuals sue over a data breach in Louisiana?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in Louisiana?

Louisiana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Louisiana limit breach lawsuits for companies with a cybersecurity program?

No. Louisiana has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Louisiana Attorney General before relying on them.

Other states with a 60-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →