1. Home
  2. State breach laws
  3. Maine

Maine data breach notification law

What Maine requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Me. Rev. Stat. tit. 10, §§ 1346–1350-B (Notice of Risk to Personal Data Act).

30 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

With only 30 days to notify residents, Maine organizations are usually still mid-response when their filing becomes public, which is the point at which outside help is easiest to justify. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Maine breach filings →

Requirements in detail

Statute
Me. Rev. Stat. tit. 10, §§ 1346–1350-B (Notice of Risk to Personal Data Act)
Deadline to notify residents
As expediently as possible and without unreasonable delay, and no more than 30 days after the business becomes aware of the breach and identifies its scope. If law enforcement delays notice, it must go out no later than seven business days after law enforcement determines that notice will not compromise the investigation.
Attorney General notification
Yes, whenever residents must be notified, regardless of the number affected. Notice goes to the appropriate regulator within the Department of Professional and Financial Regulation, or to the Attorney General if the business is not regulated by that department. Consumer reporting agencies must be notified when more than 1,000 people are notified at one time.
Penalties
A violation is a civil violation punishable by a fine of up to $500 per violation, up to a maximum of $2,500 for each day of violation, plus equitable relief or an injunction. The fines do not apply to state government, municipalities, school administrative units, or the state's public university and college systems. The Department of Professional and Financial Regulation enforces the law against the businesses it licenses, and the Attorney General enforces it against everyone else.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Maine's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Maine has no law limiting breach lawsuits for organizations that maintain a security program.

Maine breach notification FAQ

What is the data breach notification deadline in Maine?

As expediently as possible and without unreasonable delay, and no more than 30 days after the business becomes aware of the breach and identifies its scope. If law enforcement delays notice, it must go out no later than seven business days after law enforcement determines that notice will not compromise the investigation. The governing law is Me. Rev. Stat. tit. 10, §§ 1346–1350-B (Notice of Risk to Personal Data Act).

Does Maine require notifying the Attorney General of a data breach?

Yes, whenever residents must be notified, regardless of the number affected. Notice goes to the appropriate regulator within the Department of Professional and Financial Regulation, or to the Attorney General if the business is not regulated by that department. Consumer reporting agencies must be notified when more than 1,000 people are notified at one time.

What are the penalties for failing to report a data breach in Maine?

A violation is a civil violation punishable by a fine of up to $500 per violation, up to a maximum of $2,500 for each day of violation, plus equitable relief or an injunction. The fines do not apply to state government, municipalities, school administrative units, or the state's public university and college systems. The Department of Professional and Financial Regulation enforces the law against the businesses it licenses, and the Attorney General enforces it against everyone else.

Can individuals sue over a data breach in Maine?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Maine?

Maine's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Maine limit breach lawsuits for companies with a cybersecurity program?

No. Maine has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Maine Attorney General before relying on them.

Other states with a 30-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →