Law / United States / 
Montana
Notification of security breach
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify affected Montana residents of a breach of security without unreasonable delay, and simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office.
These lines are LexLint's reading of the law's text. Also read by: Montana Department of Justice, Office of Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://doj.mt.gov/office-of-consumer-protection/reporting-requirements-for-data-breaches/
- Guidance body
- Montana Department of Justice, Office of Consumer Protection
- Open questions
- Does the electronic copy that section 30-14-1704(8) requires of any person or business "required to issue a notification pursuant to this section" also apply to a person that maintains data it does not own and notifies only the owner or licensee under subsection (2)?
What it makes you log
Logging duty
Section 1704 requires a person or business that conducts business in Montana to disclose a breach to each affected Montana resident without unreasonable delay, and a person that maintains data it does not own to notify the owner. Subsection (8) has the notifier send the Attorney General's consumer protection office an electronic copy of the notice and a statement of its date and method of distribution, a filing and not a record the business keeps. Subsection (6) treats a business that follows its own notification procedures as compliant, a policy. The section sets no log, no retention period, no audit and no regulator access to a record.
- Kind
- None
- As of
What this law does
A person or business required to notify Montana residents of a breach of security must simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office; notice must be made without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the breach's scope. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .