Law / United States / 
Louisiana
Database Security Breach Notification Law, notice duty
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify each affected Louisiana resident of a breach involving personal information in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery.
- If you delay notice, notify the Attorney General in writing of the reasons for the delay within the 60 days after discovery of the breach (R.S. 51:3074(E)).
- If you maintain computerized personal information you do not own, notify the owner or licensee of a breach in the most expedient time possible and without unreasonable delay, and no later than 60 days after discovering it (R.S. 51:3074(D), (E)).
These lines are LexLint's reading of the law's text. Also read by: Louisiana Department of Justice, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's page sets out its implementing regulation, LAC 16:III.701, on reporting a breach to the Attorney General; it does not construe the sixty-day notice to residents in R.S. 51:3074(E).
- As of
- Guidance link
- https://ag.louisiana.gov/Page/DataBreach
- Guidance body
- Louisiana Department of Justice, Office of the Attorney General
- Open questions
- Does the 'sixty days from the discovery of the breach' period in R.S. 51:3074(E) run from the day a person first learns of a compromise or from the day it determines that personal information was acquired?
- Does notice sent inside the sixty-day period count as 'delayed' under R.S. 51:3074(E), so that the Attorney General must be given the reasons in writing?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
The five years run from the date of discovery of the breach of the security of the system and cover the written no-harm determination and its supporting documentation.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Notification of residents is not required when a reasonable investigation finds no reasonable likelihood of harm, and the person or business must then keep the written determination and its supporting documentation for five years from discovery and produce it to the Attorney General within thirty days of a written request. Subsection E also requires written reasons to the Attorney General when notice is delayed, which is a report and not a kept record. The security program duty in subsection A and its "conducts business in the state" prong are outside the cited subsections and are not coded; the hook is the resident whose information is breached in subsection C.
- Kind
- Explicit
- As of
- Provision
- La. R.S. 51:3074(I) (the person or business retains a copy of the written no-harm determination and supporting documentation for five years from the date of discovery and sends it to the Attorney General within thirty days of a written request)
- Trigger
- security_incident
What this law does
Notice to affected Louisiana residents is required in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery, with written reasons for any delay owed to the Attorney General. No notice at all is required if, after investigation, there is no reasonable likelihood of harm, subject to a five-year document-retention duty for that determination. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .