Law / United States / 
Louisiana
Insurance Data Security Law: notification of a cybersecurity event to the commissioner of insurance
In force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Commissioner of Insurance
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are an insurance licensee, notify the commissioner of insurance without unreasonable delay, and no later than three business days, after you determine that a cybersecurity event involving nonpublic information in your possession has occurred and either this state is your state of domicile (insurer) or home state (producer, adjuster or public adjuster) and the event is reasonably likely to materially harm a consumer residing here or a material part of your normal operations, or you reasonably believe the information involved is for 250 or more consumers residing here and a listed event has occurred.
- Provide as much as possible of the information the section lists, in electronic form as the commissioner directs, and keep updating and supplementing your notifications as material changes occur.
- Comply with the Database Security Breach Notification Law and give the commissioner a copy of the notice you send to consumers.
- If a cybersecurity event occurs in a system maintained by a third-party service provider you know of, treat it as you would an event under subsection A unless the provider gives the notice, and count your deadline from the day after the provider notifies you or you otherwise have actual knowledge.
- If you are an assuming insurer without a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
- If you are an insurer and a consumer accessed your services through an independent insurance producer and consumer notice is required, notify the producers of record of all affected consumers no later than the time you notify the consumers.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 22:2510 sends a violation of the chapter to the commissioner's penalty power under R.S. 22:18. That section lets the commissioner levy a fine of up to $1,000 for each violation in lieu of suspension or revocation of a certificate or license, up to $1,000,000 aggregate for all violations in a calendar year per insurer, person or entity since Act 325 of 2026 (the cap was $100,000 before). The commissioner may also refuse to renew, suspend or revoke a certificate of authority or license, and a timely hearing demand suspends the fine until the division of administrative law finds it warranted.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 1,000,000
- Per violation unit
- Violation
- Per violation amount
- 1,000
What this law does
Under Revised Statutes 22:2506, a licensee must notify the commissioner of insurance without unreasonable delay, and in no event later than three business days, from a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred when a listed criterion is met.
Under section 22:2503 of the Revised Statutes, a licensee is any person licensed, authorized to operate, or registered or required to be licensed, authorized, or registered pursuant to the insurance laws of this state.
Revised Statutes 22:2506 applies when this state is the licensee's state of domicile (an insurer) or home state (a producer or adjuster) and the event has a reasonable likelihood of materially harming a consumer residing in this state or a material part of the licensee's normal operations, or when the licensee reasonably believes the nonpublic information involved is for 250 or more consumers residing in this state and a listed event has occurred.
Under Revised Statutes 22:2506, a licensee has a continuing obligation to update and supplement its initial and subsequent notifications to the commissioner regarding material changes to previously provided information. Revised Statutes 22:2506 requires a licensee to comply with the Database Security Breach Notification Law and to give the commissioner a copy of the notice sent to consumers if the licensee must notify the commissioner.
Under Revised Statutes 22:2509(C), a licensee subject to Revised Statutes 51:3076 is exempt from Revised Statutes 22:2506 if it notifies affected consumers and the commissioner consistently with the Gramm-Leach-Bliley Act and at the same time as it notifies federal regulatory authorities. Under Revised Statutes 22:2510, the commissioner may impose a penalty for a violation of the Insurance Data Security Law pursuant to Revised Statutes 22:18.
Under section 22:18 of the Revised Statutes, the commissioner of insurance may, in lieu of suspension or revocation of a certificate of authority or license, levy a fine not to exceed $1,000 for each violation per insurer, person or entity violating any provision of the Insurance Code.
Act 325 of the 2026 Regular Session increased the aggregate annual cap on the commissioner's fines under section 22:18 from $100,000 to $1,000,000 for insurers, persons, entities, health insurance issuers and limited licensees per calendar year. Act 325 of the 2026 Regular Session is effective .
When LexLint raises it
When your app profile says your app is an insurer.