Florida
From US data breach notification laws: After a data breach, how fast must a business tell people, and who else must it tell?
Law: 501.171
The section that holds the state's general breach notification duty for businesses, as the source names it.
501.171 security of confidential personal information
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Read once.
Days to tell residents: 30 days
The outer limit in days for telling affected residents, as stated. Blank where no number is stated. States start the clock differently, at discovery or at determining a breach happened, and the quote shows which.
no later than 30 days after the determination of a breach or reason to believe a breach occurred
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
How fast, in the law's words: as expeditiously as practicable and without unreasonable delay
The law's own words for how quickly residents must be told, apart from any day count.
notice to individuals shall be made as expeditiously as practicable and without unreasonable delay
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
Attorney general told: Yes
Yes if the source says the state attorney general or its equivalent must be told of a breach in at least some cases. Florida's Department of Legal Affairs and Oregon's Attorney General count.
a covered entity shall provide notice to the department of any breach of security affecting 500 or more individuals in this state
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
Residents before the AG is told: 500 residents
The number of affected residents at which the attorney general must be told, as stated. Blank where no number is stated. The quote shows whether it means that many or more than that many.
affecting 500 or more individuals in this state
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
Days to tell the AG: 30 days
The deadline in days for telling the attorney general, as stated. Blank where no number is stated. Clocks differ: some run from the breach, and others from telling residents, as the quote shows.
no later than 30 days after the determination of the breach or reason to believe a breach occurred
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
Encrypted data excepted: Yes
Yes if the text limits the duty to unencrypted data, or leaves encrypted data out. Stolen keys can undo this in several states.
the term also does not include information that is encrypted
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.
Low-harm exception: Yes
Yes if the text lets a business skip notice after finding that harm or misuse is unlikely, or only counts breaches that create a real risk.
notice to the affected individuals is not required if, after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm
Source: https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. Read 2026-11-01. Checked by a second reader.