Law / United States / 
Illinois
Personal Information Protection Act, data breach notification
815 ILCS 530/1 et seq. (P.A. 94-36, eff. )
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice, Security
- Audit expectation
- none
What it requires
- Notify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual.
- Notify the Illinois Attorney General once a single breach requires you to notify more than 500 Illinois residents, in the most expedient time possible and without unreasonable delay, and in no event later than when you notify those residents.
- If you are a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate that notifies the federal Secretary of Health and Human Services of a breach, notify the Illinois Attorney General within 5 business days of notifying the Secretary.
- If you are a State agency, notify the Illinois Attorney General within 45 days of discovering a single breach affecting more than 250 Illinois residents, or when you first notify residents if that is sooner, unless you have good cause for reasonable delay.
- If you are a State agency directly responsible to the Governor, notify the Chief Information Security Officer of the Department of Innovation and Technology and the Attorney General without delay, and no later than 72 hours after discovering a breach affecting more than 250 Illinois residents or an instance of aggravated computer tampering.
- If you are a State agency that has had a breach, report it to the General Assembly within 5 business days of discovering or being notified of the breach, listing the breaches and the corrective measures taken.
- If you are a State agency and you determine who perpetrated a breach, report that to the General Assembly within 5 days after the determination, unless the report would jeopardize the security of Illinois residents or compromise a security investigation.
These lines are LexLint's reading of the law's text. Also read by: Office of the Illinois Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
815 ILCS 530/20 makes a PIPA violation an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act; the civil penalty is stated in 815 ILCS 505/7(b), not in PIPA itself. The Attorney General or a State's Attorney may seek a civil penalty of up to $50,000 for the practice found unlawful, or up to $50,000 per violation where the court finds the practice was entered into with intent to defraud. No PIPA-specific or Consumer Fraud Act provision states a fixed per-person private-plaintiff damages figure; a private plaintiff recovers actual damages only under 815 ILCS 505/10a.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Illinois Attorney General or a State's Attorney, enforcing a PIPA violation as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.
Enforcement record
The Illinois Attorney General's own press-release register is dated and public, but it lists every area of the Office's work in one chronological feed rather than by the statute enforced, so it states no count of actions taken under this Act specifically. The closest data-security matter in the twelve months to September 2026 is a multistate settlement of bankruptcy claims against 23andMe over a genetic data breach; the Office's own announcement grounds that claim in unreasonable data-security practices generally, not in a stated violation of this Act, so it is not counted here. The enforcement archive does not break out this Act's own actions, so it gives no yearly count.
- As of
- Source link
- https://illinoisattorneygeneral.gov/News-Room/index
Settledness
- As of
- Guidance link
- https://illinoisattorneygeneral.gov/Consumer-Protection/For-Businesses/Data-Breach/
- Guidance body
- Office of the Illinois Attorney General
- Open questions
- How many days after discovery may a data collector take to notify Illinois residents and still act 'in the most expedient time possible and without unreasonable delay' under 815 ILCS 530/10(a), when neither the Act nor the Attorney General's guidance states a number of days for data collectors?
- Does 'unauthorized acquisition of computerized data' in the definition of 'breach of the security of the system data' reach unauthorized access to personal information that is not shown to have been copied or removed?
What it makes you log
Logging duty
Only a State agency that collects personal data carries a record-shaped duty: it must report each breach to the General Assembly within 5 business days and then file an annual report listing every breach with the corrective measures taken, which cannot be done without a kept list. The report goes to the General Assembly and is not stated to be published, and the section names no contents from the log vocabulary. A data collector's duties in sections 10 and 45 are to notify residents and the Attorney General (including a description of the breach and the number of residents affected) and to keep reasonable security measures, which are notices and safeguards and not a record. Nothing in the Act sets a retention period, and the annual list is a party's own report, so no audit is expected. The Act applies to a data collector that owns or licenses personal information concerning an Illinois resident, which is a residence test.
- Kind
- Implicit
- As of
- Provision
- 815 ILCS 530/25 (a State agency that has had a breach reports it to the General Assembly within 5 business days and files an annual report listing all breaches and the corrective measures taken)
- Trigger
- security_incident
What this law does
Requires a data collector, government agency or private entity, holding computerized personal information of Illinois residents to notify affected residents of a security breach in the most expedient time possible and without unreasonable delay.
Personal information expressly includes unique biometric data used to authenticate an individual, such as a fingerprint, retina or iris image, or other physical or digital biometric representation, alongside a name paired with a Social Security number, account number, or medical information.
A data collector must notify the Illinois Attorney General once a single breach affects more than 500 Illinois residents, and a State agency must do so above 250 residents; a violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .