Law / United States / 
Louisiana
Database Security Breach Notification Law, reasonable security procedures and destruction duty
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Retention
What it requires
- This binds any person conducting business in Louisiana, or any person or state or local agency, that owns or licenses computerized data including personal information; unlike the Louisiana Data Privacy Act, it carries no revenue, volume, or sale-percentage threshold.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect personal information from unauthorized access, destruction, use, modification, or disclosure.NIST CSF 2.0PR.DS-01
- Take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable.NIST CSF 2.0ID.AM-08
- Expect a violation of either duty to be enforceable as an unfair trade practice, by the Attorney General for injunctive relief and, because R.S. 51:3074(J)'s deeming clause carries no exclusion of R.S. 51:1409, by a private action from a harmed Louisiana resident for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.
- Do not conflate this pre-existing safeguards duty with the Louisiana Data Privacy Act's own controller security-of-processing duty at R.S. 51:1780.4(A)(1)(b), a separate, later-enacted comprehensive-regime clause documented under this jurisdiction's privacy topic rather than here.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- 3.5Destroying data in a way that fits its sensitivity and storage type.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
R.S. 51:3074(J) makes a violation of the Chapter an unfair act or practice under R.S. 51:1405(A), which brings it within the civil penalty in R.S. 51:1407(B): on the Attorney General's request the court may impose a civil penalty with no stated amount, and where it finds the practice was entered into with intent to defraud, a penalty of up to $5,000 for each violation, which is the highest stated figure and the one coded. R.S. 51:1407(C) adds up to $5,000 for each violation committed against an elder person or a person with a disability. The statute names no aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
No fixed per-person figure: a court awards actual damages, trebled to three times actual damages if the violation was used knowingly after Attorney General notice, plus reasonable attorney fees and costs. The action may be brought only individually, not in a representative or class capacity, and is subject to a one-year liberative prescription running from the transaction or act giving rise to the right of action.
- As of
Who enforces it
Enforcement body
No dedicated regulator is named for this specific duty. A violation is deemed an unfair trade practice under R.S. 51:1405(A) by the chapter's own deeming clause (R.S. 51:3074(J)); the Attorney General holds separate injunctive authority under R.S. 51:1407 and 1408 and may ask a court to impose the civil penalty in R.S. 51:1407(B), and a harmed Louisiana resident may bring a private action under R.S. 51:1409, mailing a copy of the petition and any judgment to the Attorney General.
Settledness
- As of
- Open questions
- What counts as 'reasonable security procedures and practices appropriate to the nature of the information' under R.S. 51:3074(A), a phrase R.S. 51:3073 does not define?
- Does the exemption of a 'federally insured financial institution' in R.S. 51:1406(1) take such an institution outside the R.S. 51:1405(A) route that R.S. 51:3074(J) uses for a violation of R.S. 51:3074(A) and (B)?
- Does an 'ascertainable loss of money or movable property' under R.S. 51:1409(A) arise from a failure to keep reasonable security procedures where no unauthorized acquisition of the information has occurred?
What this law does
Any person that conducts business in Louisiana, or any person or agency that owns or licenses computerized data including personal information, must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure, and must take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained.
Because the same chapter's deeming clause, R.S. 51:3074(J), reaches a violation of this safeguards duty exactly as it reaches the chapter's breach-notice duty, and carries no exclusion of R.S. 51:1409, a Louisiana resident harmed by a violation can bring a private action for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .