Processes personal data, in Louisiana

La. R.S. 51:3073 · Read the law's page

• Treat a biometric identifier used to authenticate access to a system or account as covered personal information under this statute; its biometric definition is narrower than, and should not be conflated with, the LDPA's own biometric data definition.

La. R.S. 51:1409(A) · Read the law's page

• Expect a violation of Louisiana's breach notification duty to be actionable by any affected Louisiana resident who suffers an ascertainable loss, for actual damages (trebled if knowing, after Attorney General notice) plus attorney fees and costs.

La. R.S. 51:3074(A), (B) · Read the law's page

• This binds any person conducting business in Louisiana, or any person or state or local agency, that owns or licenses computerized data including personal information; unlike the Louisiana Data Privacy Act, it carries no revenue, volume, or sale-percentage threshold.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect personal information from unauthorized access, destruction, use, modification, or disclosure.
• Take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable.
• Expect a violation of either duty to be enforceable as an unfair trade practice, by the Attorney General for injunctive relief and, because R.S. 51:3074(J)'s deeming clause carries no exclusion of R.S. 51:1409, by a private action from a harmed Louisiana resident for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.
• Do not conflate this pre-existing safeguards duty with the Louisiana Data Privacy Act's own controller security-of-processing duty at R.S. 51:1780.4(A)(1)(b), a separate, later-enacted comprehensive-regime clause documented under this jurisdiction's privacy topic rather than here.

La. R.S. 51:3074(J), 51:1405(A) · Read the law's page

• Do not assume Louisiana forecloses a private right of action for a data-privacy violation generally. The comprehensive LDPA does; this separate breach-notification statute does not, because its deeming clause carries no carve-out of R.S. 51:1409.

La. R.S. 22:918 · Read the law's page

• If you are an insurer of life insurance, long-term care insurance or annuity contracts (including insurance agents and third-party administrators), do not take into consideration, in eligibility, premium or other underwriting decisions, that an individual or family member participated in genetic research or testing, unless the individual provides the results for your consideration.
• Do not require or request an individual or family member to take a genetic test.
• Do not cancel, limit, refuse to renew, deny coverage or increase premium rates on an existing policy because an individual or family member requested or received genetic services or participated in genetic research.
• Do not purchase genetic information about an individual without the individual's written consent.

La. R.S. 22:1023 · Read the law's page

• If you are an insurer, do not terminate, restrict, cancel, refuse to renew, deny or exclude coverage, impose an excluding rider, set premium or cost-sharing differentials, or otherwise discriminate against an individual or family member on the basis of genetic information or a request for or receipt of genetic services.
• Do not request, require or purchase genetic information of an individual or family member for underwriting purposes, or before enrollment in connection with enrollment, and do not request or require that an individual, family member or group member undergo a genetic test.
• Do not obtain genetic information from an insured or enrollee, or from their DNA sample, without first obtaining written informed consent, and make any authorization for disclosure meet the section's form: written, signed and dated, naming the discloser and recipient and the specific information and purpose, and expiring within 60 days.
• Do not retain an insured's or enrollee's genetic information without first obtaining their authorization, unless the section's exceptions apply, and treat the information as the insured's or enrollee's property.
• Provide each applicant or enrollee, in the application or enrollment information, a written statement of their rights under the section in a form noticeable and understandable to an average applicant or enrollee.

La. R.S. 51:3074(C), (E), (I) · Read the law's page

• Notify each affected Louisiana resident of a breach involving personal information in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery.
• If you delay notice, notify the Attorney General in writing of the reasons for the delay within the 60 days after discovery of the breach (R.S. 51:3074(E)).
• If you maintain computerized personal information you do not own, notify the owner or licensee of a breach in the most expedient time possible and without unreasonable delay, and no later than 60 days after discovering it (R.S. 51:3074(D), (E)).

La. R.S. 51:3184 and 51:3185 · Read the law's page

• If you are a medical facility, human genomic research facility or company, store human genetic sequencing data only at geographic locations outside any foreign adversary country (the People's Republic of China including Hong Kong, Cuba, Iran, North Korea or Russia), and do not allow remote access to that storage, other than open data, from a foreign adversary country.
• If you store human genetic sequencing data, including through contracts with third-party data storage companies, secure it with reasonable encryption methods, restrictions on access and other cybersecurity best practices.

La. R.S. 51:1780.1(12), 1780.4(F), (O) · Read the law's page

• To treat data as deidentified under the LDPA, take reasonable measures to ensure that it cannot be associated with an individual (La. R.S. 51:1780.4(F)(1)(a)).
• Publicly commit to maintaining and using deidentified data without attempting to reidentify it (La. R.S. 51:1780.4(F)(1)(b)).
• Contractually obligate every recipient of deidentified data to comply with the LDPA (La. R.S. 51:1780.4(F)(1)(c)).
• If you disclose pseudonymous or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of them (La. R.S. 51:1780.4(O)(2)).

La. R.S. 51:1780.1(3), (29) · Read the law's page

• Treat an identifier deliberately extracted from a photograph, video, or audio recording to identify a specific Louisiana resident as biometric and sensitive data under the LDPA, notwithstanding the recording's own public or non-public origin.
• Obtain a Louisiana consumer's consent before selling sensitive data, if you meet the LDPA's revenue-from-sale applicability threshold.
• Treat genetic data, health diagnosis information, racial or ethnic origin, religious belief, sexuality, immigration status, a known child's data, and precise geolocation as sensitive data requiring heightened handling.

La. R.S. 51:1780.1, 1780.2, 1780.4 · Read the law's page

• Determine whether you do business in Louisiana and meet at least one of the LDPA's three independent thresholds ($25 million annual gross revenue, 75,000 or more consumers, households, or devices whose personal data it buys, receives, sells or shares for commercial purposes annually, or 50% or more of revenue from selling personal data) before relying on any exemption.
• Confirm whether a sector exemption applies. The LDPA excludes state agencies and political subdivisions, GLBA-regulated financial institutions, nonprofits, higher-education institutions, and HIPAA-covered entities and business associates.

La. R.S. 51:1780.3 · Read the law's page

• Give a Louisiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy, once the LDPA takes effect January 1, 2027.
• Offer a Louisiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.
• Do not include a contract term waiving or limiting a Louisiana consumer's LDPA rights; such a term is void and unenforceable.

La. R.S. 51:1780.5 · Read the law's page

• Expect an LDPA violation to be enforced exclusively by the Louisiana Attorney General; the Act forecloses a private right of action by name.
• Between January 1 and July 31, 2027, use the 30-day Attorney General notice-and-cure period: cure the violation the notice identifies, give the Attorney General a written statement that you cured it, submit supporting documentation showing how, and change your internal policy if necessary so that no further violation occurs. The Attorney General may not start an investigation unless you have done all of these.