1. Home
  2. State breach laws
  3. Pennsylvania

Pennsylvania data breach notification law

What Pennsylvania requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by 73 Pa. Stat. §§ 2301–2330 (Breach of Personal Information Notification Act, Act 94 of 2005, as amended).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Pennsylvania's law changed in September 2024: the Attorney General now has to be notified when more than 500 residents are affected, and breaches involving Social Security, driver's license, or bank account numbers require 12 months of free credit monitoring for the people affected. That mandate puts a real per-record cost on every incident, and the new AG requirement means Pennsylvania breaches that used to stay private are now public. Both are reasons an organization that just filed will take a call about preventing the next one.

See recent Pennsylvania breach filings →

Requirements in detail

Statute
73 Pa. Stat. §§ 2301–2330 (Breach of Personal Information Notification Act, Act 94 of 2005, as amended)
Deadline to notify residents
Without unreasonable delay after determining that a breach occurred, allowing time to determine its scope and restore the system. State agencies, counties, public schools, and municipalities must notify within 7 business days after the determination. Notice may be delayed if law enforcement advises in writing that it would impede an investigation.
Attorney General notification
Yes, at the same time as notice to individuals, when more than 500 Pennsylvania residents must be notified. Entities subject to the state insurance data security law are exempt from this requirement. State agencies must notify the Office of Attorney General at the same time as individuals regardless of size. Counties, public schools, and municipalities must notify the county district attorney within 3 business days. Consumer reporting agencies must be notified without unreasonable delay when more than 500 people are notified at one time.
Penalties
A violation is treated as an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, and the Attorney General has exclusive authority to sue. Under that law, civil penalties for willful violations are up to $1,000 per violation, or up to $3,000 per violation when the victim is 60 or older, and up to $5,000 per violation of a court injunction.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Pennsylvania's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Pennsylvania has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
Act 33 of 2024 (SB 824), signed June 28, 2024 and effective September 26, 2024, added Attorney General notice when more than 500 residents are affected, lowered the consumer reporting agency threshold from more than 1,000 to more than 500 people, amended the definition of personal information, and required organizations to provide 12 months of free credit monitoring and a free credit report when Social Security numbers, bank account numbers, or driver's license or state ID numbers are involved.

Pennsylvania breach notification FAQ

What is the data breach notification deadline in Pennsylvania?

Without unreasonable delay after determining that a breach occurred, allowing time to determine its scope and restore the system. State agencies, counties, public schools, and municipalities must notify within 7 business days after the determination. Notice may be delayed if law enforcement advises in writing that it would impede an investigation. The governing law is 73 Pa. Stat. §§ 2301–2330 (Breach of Personal Information Notification Act, Act 94 of 2005, as amended).

Does Pennsylvania require notifying the Attorney General of a data breach?

Yes, at the same time as notice to individuals, when more than 500 Pennsylvania residents must be notified. Entities subject to the state insurance data security law are exempt from this requirement. State agencies must notify the Office of Attorney General at the same time as individuals regardless of size. Counties, public schools, and municipalities must notify the county district attorney within 3 business days. Consumer reporting agencies must be notified without unreasonable delay when more than 500 people are notified at one time.

What are the penalties for failing to report a data breach in Pennsylvania?

A violation is treated as an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, and the Attorney General has exclusive authority to sue. Under that law, civil penalties for willful violations are up to $1,000 per violation, or up to $3,000 per violation when the victim is 60 or older, and up to $5,000 per violation of a court injunction.

Can individuals sue over a data breach in Pennsylvania?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Pennsylvania?

Pennsylvania's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Pennsylvania limit breach lawsuits for companies with a cybersecurity program?

No. Pennsylvania has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Pennsylvania Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →