1. Home
  2. State breach laws
  3. Missouri

Missouri data breach notification law

What Missouri requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Mo. Rev. Stat. § 407.1500.

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Missouri sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Missouri breach filings →

Requirements in detail

Statute
Mo. Rev. Stat. § 407.1500
Deadline to notify residents
Without unreasonable delay, consistent with law enforcement needs and any steps needed to find contact information, determine the scope of the breach, and restore the system. There is no fixed number of days.
Attorney General notification
Yes, when notice goes to more than 1,000 consumers at one time. The business must then notify the Attorney General's office and all nationwide consumer reporting agencies without unreasonable delay of the timing, distribution, and content of the notice.
Penalties
The Attorney General has exclusive authority to sue for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Missouri's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Missouri has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
None to section 407.1500, which dates from 2009. Separately, House Bill 974 (2025) created the Insurance Data Security Act (sections 375.1400 to 375.1427), effective January 1, 2026. It requires insurance licensees to notify the Director of the Department of Commerce and Insurance within four business days after determining that a qualifying cybersecurity event occurred, including certain events involving 250 or more Missouri residents, and to send the director a copy of any consumer notice required under section 407.1500.

Missouri breach notification FAQ

What is the data breach notification deadline in Missouri?

Without unreasonable delay, consistent with law enforcement needs and any steps needed to find contact information, determine the scope of the breach, and restore the system. There is no fixed number of days. The governing law is Mo. Rev. Stat. § 407.1500.

Does Missouri require notifying the Attorney General of a data breach?

Yes, when notice goes to more than 1,000 consumers at one time. The business must then notify the Attorney General's office and all nationwide consumer reporting agencies without unreasonable delay of the timing, distribution, and content of the notice.

What are the penalties for failing to report a data breach in Missouri?

The Attorney General has exclusive authority to sue for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach, or per series of similar breaches discovered in a single investigation.

Can individuals sue over a data breach in Missouri?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Missouri?

Missouri's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Missouri limit breach lawsuits for companies with a cybersecurity program?

No. Missouri has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Missouri Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →