Law / United States / 
Florida
Florida Information Protection Act, breach notification
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Kept, Filed with regulator, Produced on request
What it requires
- Notify the Florida Department of Legal Affairs of a breach of security affecting 500 or more individuals in Florida as expeditiously as practicable, and no later than 30 days after determining a breach occurred or having reason to believe one occurred.
- Notify each affected Florida individual of a breach as expeditiously as practicable and without unreasonable delay, and no later than 30 days after determining a breach occurred or having reason to believe one occurred; you may have 15 additional days if you give the Florida Department of Legal Affairs written good cause for the delay within those 30 days.
- If you need 15 additional days to notify affected individuals, give the Florida Department of Legal Affairs written notice of good cause for the delay within 30 days after determining a breach occurred or having reason to believe one occurred.
- If you determine that a breach is not likely to result in identity theft or other financial harm and so do not notify individuals, submit that written determination to the Florida Department of Legal Affairs within 30 days after the determination.
- If you are a third-party agent that maintains a system that suffers a breach of security, notify the covered entity as expeditiously as practicable and no later than 10 days after determining a breach occurred or having reason to believe one occurred.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "any information regarding an individual's geolocation" in Fla. Stat. § 501.171(1)(g)1.a.(VII) reach coarse location, such as a city or region inferred from an IP address, or only precise location?
- Does "timely" in § 501.171(4)(g) require a covered entity that follows its federal regulator's notice rules to deliver a copy of that notice to the Department of Legal Affairs within the 30 days that § 501.171(3)(a) allows?
What it makes you log
Who may demand the log
Regulator
Log retention
Subsection (4)(c): the written determination that notice to individuals is not required is maintained for at least 5 years.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
When a covered entity decides that a breach has not and will not likely cause identity theft or other financial harm, and so gives affected individuals no notice, the determination must be documented in writing and maintained for at least 5 years, and a copy goes to the Department of Legal Affairs within 30 days (subsection (4)(c)). Separately, on the Department's request the entity must provide a police report, incident report or computer forensics report, a copy of its breach policies and the steps taken to rectify the breach (subsection (3)(c)). The clauses name no fields for the record. A third-party agent's duty to notify the covered entity within 10 days and the disposal rule in subsection (8) are not records. The Act reaches breaches affecting individuals in the state, which is a location test and not a residence test.
- Kind
- Explicit
- As of
- Provision
- Fla. Stat. 501.171(4)(c) and (3)(c)
- Trigger
- security_incident
What this law does
A covered entity, defined broadly as any commercial entity that acquires, maintains, stores, or uses personal information, with no revenue gate of any kind, must provide notice to the Department of Legal Affairs of a breach affecting 500 or more individuals in Florida as expeditiously as practicable and no later than 30 days after determining a breach occurred or having reason to believe one occurred, and must give notice to each affected Florida individual on the same 30-day deadline, extendable by 15 days on a written good-cause showing.
For the notice requirements in subsections (3) through (6), the term covered entity includes a governmental entity, so the duty reaches public bodies as well as commercial entities. Originally enacted in 2014 (ch. 2014-189/190) and amended repeatedly since, including by the same 2023 bill that created FDBR and again by ch. 2026-52 in the 2026 session. Chapter 2014-189, which created the section, took effect on .
Subsection (10) provides that the section does not establish a private cause of action. Subsection (9) treats a violation as an unfair or deceptive trade practice in an action the Department of Legal Affairs brings under s. 501.207.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .