1. Home
  2. State breach laws
  3. Montana

Montana data breach notification law

What Montana requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Mont. Code Ann. §§ 30-14-1704 and 30-14-1705.

No fixed deadline
Notification deadline
Required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

Montana sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. Private-action exposure is limited, so the pressure is mostly regulatory and the pitch is about penalties, remediation, and not being on the list twice.

See recent Montana breach filings →

Requirements in detail

Statute
Mont. Code Ann. §§ 30-14-1704 and 30-14-1705
Deadline to notify residents
Without unreasonable delay after discovering or being notified of the breach, consistent with law enforcement needs and any steps needed to determine the scope of the breach and restore the system. There is no fixed number of days.
Attorney General notification
Yes, for any breach that requires notice to Montana residents. At the same time it notifies residents, the business must send the Attorney General's Office of Consumer Protection an electronic copy of the notice and a statement of the date and method of distribution, without any personally identifying information. A business that refers people to consumer reporting agencies in its notice must coordinate the timing, content, and distribution of the notice with those agencies.
Penalties
A violation is treated as an unfair trade practice under section 30-14-103. The Montana Department of Justice can seek injunctions and civil fines of up to $10,000 per violation under section 30-14-142.
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
Montana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Montana has no law limiting breach lawsuits for organizations that maintain a security program.

Montana breach notification FAQ

What is the data breach notification deadline in Montana?

Without unreasonable delay after discovering or being notified of the breach, consistent with law enforcement needs and any steps needed to determine the scope of the breach and restore the system. There is no fixed number of days. The governing law is Mont. Code Ann. §§ 30-14-1704 and 30-14-1705.

Does Montana require notifying the Attorney General of a data breach?

Yes, for any breach that requires notice to Montana residents. At the same time it notifies residents, the business must send the Attorney General's Office of Consumer Protection an electronic copy of the notice and a statement of the date and method of distribution, without any personally identifying information. A business that refers people to consumer reporting agencies in its notice must coordinate the timing, content, and distribution of the notice with those agencies.

What are the penalties for failing to report a data breach in Montana?

A violation is treated as an unfair trade practice under section 30-14-103. The Montana Department of Justice can seek injunctions and civil fines of up to $10,000 per violation under section 30-14-142.

Can individuals sue over a data breach in Montana?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in Montana?

Montana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Montana limit breach lawsuits for companies with a cybersecurity program?

No. Montana has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Montana Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →