Law / United States / 
Alaska
Alaska Personal Information Protection Act, breach notification duty
Alaska Stat. Secs. 45.48.010-45.48.070
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach of the security of an information system containing an Alaska resident's personal information to each affected resident in the most expeditious time possible and without unreasonable delay.NIST Privacy FrameworkCM.AW-P7
- Document and retain for five years any determination, made after investigation and written notice to the Alaska Attorney General, that a breach is unlikely to cause resident harm and so does not require disclosure.NIST Privacy FrameworkPR.PO-P7
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Alaska's personal information definition does not include any of those categories.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a person that holds personal information on Alaska residents but has no place of business in Alaska 'a person doing business' within AS 45.48.090(2)(A), and so a 'covered person' that must disclose a breach under AS 45.48.010(a)?
What it makes you log
Log retention
Five years is a minimum for the written determination that a breach is not reasonably likely to cause harm; the statute states no end date for the documentation and no period for any other record.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A covered person that decides, after investigation and written notice to the Attorney General, that a breach is not reasonably likely to cause harm, and so skips notifying residents, must document the determination in writing and maintain the documentation for five years. The statute lists no fields the documentation must hold and names no one who may demand it, and the Attorney General's notice, which may not be treated as a public record, is a filing rather than the kept record.
- Kind
- Explicit
- As of
- Provision
- AS 45.48.010(c)
- Trigger
- security_incident
What this law does
A covered person (a person doing business, a governmental agency, or a person with more than 10 employees) that owns or licenses personal information on an Alaska resident must, after discovering or being notified of a breach of the security of the information system containing it, disclose the breach to each affected resident in the most expeditious time possible and without unreasonable delay.
Disclosure is not required if, after an appropriate investigation and written notice to the Alaska Attorney General, the covered person determines there is no reasonable likelihood of harm, a determination that must be documented and kept for five years.
Personal information covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account, credit card, or debit card number with any needed access code; biometric, genetic, and health data are absent from the definition entirely, so a breach of biometric data alone triggers no notice duty under this Act.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .