Law / United States / 
Mississippi
Breach notification law, notice of security breach
Miss. Code Ann. § 75-24-29(2)-(3)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach of security to all affected Mississippi individuals without unreasonable delay, unless your investigation reasonably determines the breach will not likely result in harm.
- Do not rely on this statute to cover a breach exposing only biometric data; its personal information definition has no biometric element.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What must an "appropriate investigation" establish before a person "reasonably determines that the breach will not likely result in harm to the affected individuals" under Miss. Code Ann. § 75-24-29(3), and must the determination be recorded?
What it makes you log
Logging duty
Subsection (3) requires a person who conducts business in the state to disclose a breach to every affected individual without unreasonable delay, and subsection (2)(a) defines the breach. Notice to individuals is a notification and no record is required: the person need only determine, after an appropriate investigation, that the breach will not likely cause harm to be excused, and the text does not say that finding must be written down. Subsection (6) lists the notice methods and subsection (7) lets a person follow its own security breach procedures, which are policies. The section sets no log, no retention period, no audit and no regulator access to a record. The reach is twofold: the duty binds a person who conducts business in Mississippi, and the affected individual is defined as a resident of the state.
- Kind
- None
- As of
What this law does
A person who conducts business in Mississippi and whose data includes personal information must disclose a breach of security to all affected individuals without unreasonable delay, subject to completing an investigation; notification is not required if the person reasonably determines, after investigation, that the breach will not likely result in harm.
Personal information is an individual's name combined with a Social Security number, a driver's license, state identification card, or tribal identification card number, or an account or credit or debit card number with a required access credential, and excludes publicly available information lawfully made available from government records or widely distributed media; it has no biometric element.
Enacted as HB 583 (2010), effective , and amended by HB 277 (2021, effective ), which added the tribal identification card number as a qualifying element; every other subsection, including the enforcement clause, is unchanged since 2010.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .