Law / United States / 
Louisiana
Louisiana Data Privacy Act (Act No. 502), applicability and controller duties
La. R.S. 51:1780.1, 1780.2, 1780.4
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Determine whether you do business in Louisiana and meet at least one of the LDPA's three independent thresholds ($25 million annual gross revenue, 75,000 or more consumers, households, or devices whose personal data it buys, receives, sells or shares for commercial purposes annually, or 50% or more of revenue from selling personal data) before relying on any exemption.
- Confirm whether a sector exemption applies. The LDPA excludes state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, nonprofits, higher-education institutions, and Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does 'annual gross revenues in excess of twenty-five million dollars' in R.S. 51:1780.2(A)(1) count a business's worldwide revenues or only the revenues it earns in Louisiana?
- Are the 'consumers, households, or devices' counted toward the 75,000 threshold in R.S. 51:1780.2(A)(2) only those located in Louisiana, given that 'consumer' is limited to a resident but 'household' and 'device' are not defined?
- Does a person 'do business in the state' under R.S. 51:1780.2(A) when it sells only online to Louisiana residents and has no office, employee or property in Louisiana?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of the listed processing activities, and the assessment must weigh the benefits of the processing against the risks to the consumer, so the record shows the basis for the processing decision. The assessment is made available to the Attorney General under a civil investigative demand and is confidential and exempt from public inspection. The section sets no period for keeping the assessment. Section 1780.4(D) also makes a processor give the controller, on reasonable request, the information needed to show the processor complied, and lets a processor give the controller an independent assessor's report on request; those are contract terms between the two parties and are not coded as a regulator log. The reach of the whole Act is coded: it applies to a person that does business in the state, and its consumer is a resident.
- Kind
- Implicit
- As of
- Provision
- La. R.S. 51:1780.4(E)(1) and (3) (a controller documents a data protection assessment of each targeted advertising, sale, profiling, sensitive data or heightened-risk processing activity and makes it available to the Attorney General on a civil investigative demand)
- Trigger
- personal_data_processing
What this law does
The Louisiana Data Privacy Act, enacted as Act No. 502 of the 2026 Regular Session (formerly SB 386) and signed by Governor Landry on , applies to a person or entity doing business in Louisiana that meets any one of three independent thresholds: annual gross revenue exceeding $25 million, annually buying, receiving, selling, or sharing for commercial purposes the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenue from selling personal data.
Exemptions include state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, nonprofits, higher-education institutions, and Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates, plus a separate household or personal-activity carve-out. Controllers and processors carry General Data Protection Regulation (GDPR) and VCDPA-style duties, including data protection assessments, processor contracts, and purpose limitation, under Sec. 1780.4. The Act takes effect .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .