Cybersecurity · Florida law
What the Florida Information Protection Act requires after a breach, in plain English, with a timeline and a checklist to prepare now. General information, not legal advice.
30-day deadline for individual notices
Attorney General notice at 500 Floridians
Reasonable security measures are required
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Florida’s data breach notification law is the Florida Information Protection Act of 2014, section 501.171 of the Florida Statutes. If a breach exposes personal information about Florida residents, you must notify each affected person no later than 30 days after you determine a breach occurred or have reason to believe one did. If 500 or more Floridians are affected, you must also notify the Florida Department of Legal Affairs (the Attorney General’s office) within 30 days. If you notify more than 1,000 people at once, you must tell the nationwide credit bureaus too. Vendors holding your data must tell you within 10 days.
The law also requires every covered business to take reasonable measures to protect personal information before anything goes wrong. This article is general information, not legal advice. If you think you have a breach, call a lawyer who handles data privacy and your cyber insurer first.
The statute applies to a covered entity, which means almost any business that acquires, maintains, stores or uses personal information: sole proprietors, partnerships, corporations, trusts and associations. It also covers government entities and third-party agents, such as IT providers, payroll companies, cloud software vendors and billing services that hold data on your behalf.
The trigger is the resident, not your location. A Georgia company with Florida customers or employees is covered for those Floridians. A Florida company with customers in other states also has to check those states’ laws.
Do not confuse this law with the Florida Digital Bill of Rights. That newer privacy law only reaches companies with more than $1 billion in global revenue that meet other tests, according to a 2026 Seyfarth Shaw analysis. The breach law applies to businesses of every size.
Under the current statute, personal information means a person’s first name or first initial and last name combined with any of these:
A username or email address with a password or security question answer that unlocks an online account also counts, even without a name. That matters for small businesses: a stolen Microsoft 365 or payroll login can be a reportable breach on its own.
Information that is encrypted, secured or modified so it is unreadable or no longer identifies anyone falls outside the definition. Encryption is the single most useful control for staying out of the notification process.
The 30-day clock starts when you determine a breach occurred or have reason to believe one did. In practice, the days go fast.
The only built-in pause is a written request from law enforcement saying notice would interfere with a criminal investigation.
The written notice to the Department of Legal Affairs must contain:
If the Department asks, you must also provide police or forensic reports, your breach policies and the steps you took to fix the problem. That is why documentation matters from the first hour.
You do not have to notify individuals if, after an appropriate investigation and consultation with law enforcement, you reasonably determine the breach has not and will not likely cause identity theft or other financial harm. The determination must be written down, kept for at least five years and sent to the Department of Legal Affairs within 30 days.
This exception is narrower than it looks. It requires an investigation you can defend, a law enforcement contact and a paper trail. Logs that show exactly what was accessed are what make the determination possible. Without them, you are usually guessing, and notice is the safer course. Decide this with counsel.
Would your business hold up to a breach investigation? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
The statute says covered entities must take reasonable measures to protect personal information in electronic form, but it does not list them. For a 25 to 100 person business, these are the controls most often expected by insurers and investigators:
The law also requires secure disposal. When you no longer keep records with personal information, shred, erase or modify them so they cannot be read. That includes old laptops, copiers with hard drives and exported spreadsheets sitting in shared folders.
A violation is treated as an unfair or deceptive trade practice in actions brought by the Department of Legal Affairs. For missed notice deadlines, the civil penalty is $1,000 a day for the first 30 days, then $50,000 for each additional 30-day period up to 180 days, with a maximum of $500,000 per breach. The statute does not create a private right of action, although affected people may still sue under other legal theories.
Florida’s law is often one of several obligations after a breach.
JLB USA’s cybersecurity services cover the controls above, including MFA, encryption, access reviews, monitored backups, a written recovery plan and help with cyber-insurance questionnaires. If you want the step-by-step version for leavers, see our employee offboarding IT checklist.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Under section 501.171, notice to affected individuals is due no later than 30 days after you determine a breach occurred or have reason to believe one did. Notice to the Attorney General is also due within 30 days if 500 or more Floridians are affected. The statute allows 15 additional days if you give the Department written good cause for the delay within those 30 days.
Yes. It applies to businesses of any size that hold personal information about Florida residents, including companies based outside Florida. This is general information; confirm your situation with counsel.
It can be. Florida’s definition includes a username or email address combined with a password or security answer that allows access to an online account. Whether notice is required depends on the facts and the no-harm analysis.
Encrypted or otherwise unreadable data falls outside Florida’s definition of personal information, so an encrypted laptop that is lost usually does not trigger notice. Confirm the details, such as whether the key was also exposed, with counsel.
For missed notice deadlines, civil penalties run $1,000 a day for the first 30 days, then $50,000 per 30-day period up to 180 days, capped at $500,000 per breach. There is no private right of action under the statute.
