Notice of security breach of personal information

Mo. Rev. Stat. Sec. 407.1500

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 28 August 2009.

A breach notification rule binding public and private bodies.

As of 27 August 2026.

What it requires

Notify each affected Missouri consumer of a breach of security involving their personal information without unreasonable delay.
Notify the Missouri Attorney General's office and every nationwide consumer reporting agency without unreasonable delay if you provide notice to more than 1,000 consumers at one time.
Do not rely on this statute to cover a breach of biometric, genetic, or student data alone. Missouri's personal information definition carries no such element.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Any person, defined to include an individual, corporation, or other legal or commercial entity as well as a government, governmental subdivision, agency, or instrumentality, that owns or licenses personal information of a Missouri resident, or that conducts business in Missouri and owns or licenses such information, must notify the affected consumer of a breach of security without unreasonable delay.

Personal information is limited to a name combined with a Social Security number, a driver's license or other unique government identification number, a financial account or card number with an access code, a unique electronic identifier or routing code with an access code, medical information, or health insurance information, and excludes information lawfully obtained from publicly available sources or government records made available to the general public; it carries no biometric, genetic, or student-data element.

A person providing notice to more than 1,000 consumers at one time must also notify the Attorney General's office and every nationwide consumer reporting agency without unreasonable delay. The Attorney General has exclusive authority to bring an action for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach or series of related breaches, and the statute creates no private right of action.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Missouri statute text, Revised Statutes of Missouri section 407.1500

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app