1. Home
  2. State breach laws
  3. Michigan

Michigan data breach notification law

What Michigan requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Mich. Comp. Laws § 445.72 (Identity Theft Protection Act).

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Michigan has no fixed deadline and no requirement to notify the Attorney General, so there is no public state list to watch. Michigan breaches show up in HHS and SEC filings and in other states' records, which means they are easy to miss and competitors usually do. Knowingly failing to notify can cost $250 per failure, up to $750,000 per breach, and a pending bill would add a 45-day deadline and Attorney General notice at 100 residents. Both are worth knowing when the conversation turns to why the organization needs a documented response plan.

See recent Michigan breach filings →

Requirements in detail

Statute
Mich. Comp. Laws § 445.72 (Identity Theft Protection Act)
Deadline to notify residents
Without unreasonable delay. There is no fixed number of days, and notice may be delayed at the request of law enforcement.
Attorney General notification
No. Michigan does not currently require notice to the Attorney General. If more than 1,000 Michigan residents are notified, the business must also notify each nationwide consumer reporting agency.
Penalties
A person who knowingly fails to give required notice may be ordered to pay a civil fine of up to $250 for each failure, with total liability capped at $750,000 for violations arising from the same breach. The Attorney General or a prosecuting attorney may bring the action. Separately, sending a false breach notice with intent to defraud is a misdemeanor punishable by up to 93 days in jail and fines of up to $250, $500, or $750 per violation for first, second, and later offenses.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Michigan's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Michigan has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
None enacted in 2024–2026. Senate Bill 360 of 2025, which passed the Senate on August 26, 2025, would add a 45-day deadline after the breach is determined and require Attorney General notice when 100 or more residents are affected. As of October 2026 it is pending in the House Committee on Government Operations.

Michigan breach notification FAQ

What is the data breach notification deadline in Michigan?

Without unreasonable delay. There is no fixed number of days, and notice may be delayed at the request of law enforcement. The governing law is Mich. Comp. Laws § 445.72 (Identity Theft Protection Act).

Does Michigan require notifying the Attorney General of a data breach?

No. Michigan does not currently require notice to the Attorney General. If more than 1,000 Michigan residents are notified, the business must also notify each nationwide consumer reporting agency.

What are the penalties for failing to report a data breach in Michigan?

A person who knowingly fails to give required notice may be ordered to pay a civil fine of up to $250 for each failure, with total liability capped at $750,000 for violations arising from the same breach. The Attorney General or a prosecuting attorney may bring the action. Separately, sending a false breach notice with intent to defraud is a misdemeanor punishable by up to 93 days in jail and fines of up to $250, $500, or $750 per violation for first, second, and later offenses.

Can individuals sue over a data breach in Michigan?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Michigan?

Michigan's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Michigan limit breach lawsuits for companies with a cybersecurity program?

No. Michigan has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Michigan Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →