Florida’s breach law: 30 days, who to tell and how to prepare

The short answer

Florida’s data breach notification law is the Florida Information Protection Act of 2014, section 501.171 of the Florida Statutes. If a breach exposes personal information about Florida residents, you must notify each affected person no later than 30 days after you determine a breach occurred or have reason to believe one did. If 500 or more Floridians are affected, you must also notify the Florida Department of Legal Affairs (the Attorney General’s office) within 30 days. If you notify more than 1,000 people at once, you must tell the nationwide credit bureaus too. Vendors holding your data must tell you within 10 days.

The law also requires every covered business to take reasonable measures to protect personal information before anything goes wrong. This article is general information, not legal advice. If you think you have a breach, call a lawyer who handles data privacy and your cyber insurer first.

Who the law covers

The statute applies to a covered entity, which means almost any business that acquires, maintains, stores or uses personal information: sole proprietors, partnerships, corporations, trusts and associations. It also covers government entities and third-party agents, such as IT providers, payroll companies, cloud software vendors and billing services that hold data on your behalf.

The trigger is the resident, not your location. A Georgia company with Florida customers or employees is covered for those Floridians. A Florida company with customers in other states also has to check those states’ laws.

Do not confuse this law with the Florida Digital Bill of Rights. That newer privacy law only reaches companies with more than $1 billion in global revenue that meet other tests, according to a 2026 Seyfarth Shaw analysis. The breach law applies to businesses of every size.

What counts as personal information

Under the current statute, personal information means a person’s first name or first initial and last name combined with any of these:

• Social Security number
• Driver license, ID card, passport, military ID or similar government number
• Financial account, credit card or debit card number together with any required security code or password
• Medical history, condition, treatment or diagnosis
• Health insurance policy or subscriber number
• Biometric data or geolocation information

A username or email address with a password or security question answer that unlocks an online account also counts, even without a name. That matters for small businesses: a stolen Microsoft 365 or payroll login can be a reportable breach on its own.

Information that is encrypted, secured or modified so it is unreadable or no longer identifies anyone falls outside the definition. Encryption is the single most useful control for staying out of the notification process.

The timeline after a breach

The 30-day clock starts when you determine a breach occurred or have reason to believe one did. In practice, the days go fast.

1. Day 0: discovery. Contain the problem, preserve logs and call counsel and your insurer. Many cyber policies require prompt notice and the use of approved vendors.
2. Days 1 to 10: investigation. Work out what data was involved, whose it was and which states they live in. If a vendor had the breach, it owes you notice within 10 days of discovering it.
3. By day 30: individual notices. Send by mail or email. Each notice needs the date or estimated date range of the breach, a description of the information involved and contact details for questions.
4. By day 30: Attorney General notice if 500 or more Florida residents are affected. The statute allows 15 additional days if you give the Department written good cause for the delay within the first 30 days.
5. Without unreasonable delay: credit bureaus if you notify more than 1,000 people at one time.

The only built-in pause is a written request from law enforcement saying notice would interfere with a criminal investigation.

What the Attorney General notice must include

The written notice to the Department of Legal Affairs must contain:

• A synopsis of the events surrounding the breach
• The number of Florida residents affected or potentially affected
• Any free services offered, such as credit monitoring, and how to use them
• A copy of the individual notice, or an explanation of other actions taken
• Contact details for an employee or agent who can answer questions

If the Department asks, you must also provide police or forensic reports, your breach policies and the steps you took to fix the problem. That is why documentation matters from the first hour.

The no-harm exception

You do not have to notify individuals if, after an appropriate investigation and consultation with law enforcement, you reasonably determine the breach has not and will not likely cause identity theft or other financial harm. The determination must be written down, kept for at least five years and sent to the Department of Legal Affairs within 30 days.

This exception is narrower than it looks. It requires an investigation you can defend, a law enforcement contact and a paper trail. Logs that show exactly what was accessed are what make the determination possible. Without them, you are usually guessing, and notice is the safer course. Decide this with counsel.

Would your business hold up to a breach investigation? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

What reasonable measures look like

The statute says covered entities must take reasonable measures to protect personal information in electronic form, but it does not list them. For a 25 to 100 person business, these are the controls most often expected by insurers and investigators:

• Multi-factor authentication on email, remote access and any system holding customer or employee data
• Encryption on laptops, phones and stored files
• Regular access reviews and same-day removal of people who leave
• Endpoint protection and prompt security updates on every computer
• Email security to block phishing and spoofing
• Logs kept long enough to show what an intruder touched
• Monitored backups with restores that are actually tested
• Written contracts that require vendors to protect your data and report incidents quickly
• A written incident response plan with names and phone numbers

The law also requires secure disposal. When you no longer keep records with personal information, shred, erase or modify them so they cannot be read. That includes old laptops, copiers with hard drives and exported spreadsheets sitting in shared folders.

Penalties

A violation is treated as an unfair or deceptive trade practice in actions brought by the Department of Legal Affairs. For missed notice deadlines, the civil penalty is $1,000 a day for the first 30 days, then $50,000 for each additional 30-day period up to 180 days, with a maximum of $500,000 per breach. The statute does not create a private right of action, although affected people may still sue under other legal theories.

Other rules that may apply at the same time

Florida’s law is often one of several obligations after a breach.

• HIPAA. Medical practices and their business associates follow the federal breach notification rule, which has its own timing and reporting to HHS.
• FTC Safeguards Rule. Since May 13, 2024, non-bank financial businesses such as tax preparers, mortgage brokers and auto dealers must report breaches involving 500 or more consumers to the FTC within 30 days of discovery.
• Other states. Each affected person’s home state may have different deadlines and content rules.
• Contracts and insurance. Client contracts, card processors and your cyber policy may require faster notice than the statute.

Prepare before you need it

1. List where personal information lives: email, file shares, payroll, CRM, accounting, scanned documents.
2. Delete what you no longer need and encrypt what you keep.
3. Turn on logging in Microsoft 365 or Google Workspace and confirm how long it is kept.
4. Write a one-page incident plan: who calls counsel, who calls the insurer, who talks to staff.
5. Draft notice templates with counsel now, not on day 25.
6. Check vendor contracts for breach reporting duties.

JLB USA’s cybersecurity services cover the controls above, including MFA, encryption, access reviews, monitored backups, a written recovery plan and help with cyber-insurance questionnaires. If you want the step-by-step version for leavers, see our employee offboarding IT checklist.

Keep reading

• Georgia data breach notification law: what Atlanta businesses should know
• Alabama Data Breach Notification Act: the 45-day rule and security duties
• PCI DSS compliance for small business: SAQ types and how to shrink your scope
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026