1. Home
  2. State breach laws
  3. Wisconsin

Wisconsin data breach notification law

What Wisconsin requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Wis. Stat. § 134.98.

45 days
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Wisconsin's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. There is no Attorney General notice requirement, so Wisconsin incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Wisconsin breach filings →

Requirements in detail

Statute
Wis. Stat. § 134.98
Deadline to notify residents
Within a reasonable time, not to exceed 45 days after the entity learns that personal information was acquired without authorization. Notice may be delayed if a law enforcement agency asks for a delay to protect an investigation or homeland security.
Attorney General notification
No. The statute does not require notice to the Attorney General or any other state regulator. Nationwide consumer reporting agencies must be notified without unreasonable delay when a single incident requires notice to 1,000 or more individuals.
Penalties
The statute sets no civil penalties and names no enforcing agency. It says that failing to comply is not negligence or a breach of duty in itself, but it may be used as evidence of negligence or a breach of a legal duty.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Wisconsin's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Wisconsin has no law limiting breach lawsuits for organizations that maintain a security program.

Wisconsin breach notification FAQ

What is the data breach notification deadline in Wisconsin?

Within a reasonable time, not to exceed 45 days after the entity learns that personal information was acquired without authorization. Notice may be delayed if a law enforcement agency asks for a delay to protect an investigation or homeland security. The governing law is Wis. Stat. § 134.98.

Does Wisconsin require notifying the Attorney General of a data breach?

No. The statute does not require notice to the Attorney General or any other state regulator. Nationwide consumer reporting agencies must be notified without unreasonable delay when a single incident requires notice to 1,000 or more individuals.

What are the penalties for failing to report a data breach in Wisconsin?

The statute sets no civil penalties and names no enforcing agency. It says that failing to comply is not negligence or a breach of duty in itself, but it may be used as evidence of negligence or a breach of a legal duty.

Can individuals sue over a data breach in Wisconsin?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Wisconsin?

Wisconsin's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Wisconsin limit breach lawsuits for companies with a cybersecurity program?

No. Wisconsin has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Wisconsin Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →