Law / United States / 
Arkansas
Arkansas Personal Information Protection Act, reasonable security procedures
Ark. Code Ann. section 4-110-104(b)
In force since .
A security baseline statutes rule binding public and private bodies.
- Criminal exposure
- No
- Obligation class
- Security
What it requires
- This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
- This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
- There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Arkansas Attorney General, acting under the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. secs. 4-88-101 et seq.); the statute names no other regulator and no penalty amount of its own.
Settledness
- As of
- Open questions
- Ark. Code Ann. section 4-88-113 (Deceptive Trade Practices Act) creates a private cause of action for a violation of that Act: does that private right of action also reach a violation of the Personal Information Protection Act's separate reasonable-security duty at section 4-110-104(b), which section 4-110-108 places under Attorney General enforcement only?
What this law does
A person or business that acquires, owns, or licenses personal information about an Arkansas resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
This reasonable-security duty sits in the same Act, and the same code section, as the Act's separate duty to take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information that is no longer to be retained, and it is legally distinct from the Act's breach-notification duty at section 4-110-105, already researched as this jurisdiction's privacy row.
"Business" is defined to include a state agency, so the duty reaches Arkansas's own state agencies as well as private persons and businesses. The reasonable-security duty has not been amended since the Act's original 2005 enactment: the only later amendment to this subchapter located, Act 1030 of 2019, added biometric data elements to the definition of personal information and separately amended the breach-notification section, and left this duty's own text untouched.
Act 1526 of 2005 itself states no day-precise commencement date and carries no emergency clause, so it took effect on the general effective date the Arkansas Attorney General set for acts of the 2005 Regular Session that carried neither, .
The Act names no dedicated regulator and no penalty amount of its own for a violation of this duty; any violation of the subchapter is punishable only by action of the Attorney General under the Arkansas Deceptive Trade Practices Act, and whether that Act's own private-suit provision also arms a private plaintiff for a violation of the reasonable-security duty specifically was not confirmed from primary text.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .