Law / United States / 
Nevada
Security breach of personal information, notification
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Disclose a security breach of personal information to an affected Nevada resident in the most expedient time possible and without unreasonable delay. Nevada sets no fixed numeric deadline.
- Notify each nationwide consumer reporting agency without unreasonable delay if you determine that notification of the breach is required to more than 1,000 persons at any one time.
- Do not rely on this statute alone to cover a breach of biometric data with no accompanying identifier. Biometric data alone is not within this statute's definition of personal information.
- Expect an elderly or disabled Nevada resident harmed by a breach-notification violation to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.
These lines are LexLint's reading of the law's text. Also read by: Office of the Nevada Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Via the same NRS 603A.260 deeming chain, a natural person, firm, or corporate officer or managing agent who knowingly and willfully engages in the deemed deceptive trade practice is guilty of a misdemeanor (NRS 598.0999(3)(e)), or of a category B, C or D felony where the offense involves a quantifiable loss of property or services (from a category D felony at $1,200 to under $5,000, up to a category B felony at $100,000 or more, punishable by up to 20 years' imprisonment and a $15,000 fine).
Penalty structure
NRS 603A.260 deems a violation of the breach-notification duty (NRS 603A.220) a deceptive trade practice under NRS 598.0903 to 598.0999. NRS 598.0999(2) then lets the Commissioner, the Director, a district attorney, or the Attorney General recover a civil penalty of up to $15,000 per violation the court finds willful; NRS 598.0999(1) separately allows up to $10,000 per violation of a resulting court order or injunction.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 15,000
Who enforces it
Enforcement body
Nevada Attorney General, the Commissioner of Consumer Affairs, the Director of the Department of Business and Industry, or a county district attorney, via NRS 603A.260's deeming of a violation as a deceptive trade practice under NRS 598.0903 to 598.0999; also, for an elderly or disabled Nevada resident, an indirect private civil action under NRS 598.0977.
Settledness
The Attorney General's page treats notice to its own office as elective, not required.
- As of
- Guidance link
- https://ag.nv.gov/Hot_Topics/Notice_Regarding_Data_Breaches/
- Guidance body
- Office of the Nevada Attorney General
- Open questions
- How soon must a data collector disclose a breach of the security of the system data under NRS 603A.220(1), which requires disclosure "in the most expedient time possible and without unreasonable delay" but sets no number of days?
What it makes you log
Logging duty
Section 603A.220 requires a data collector that owns or licenses computerized personal information to disclose a breach to each affected resident, a data collector that only maintains the data to notify the owner at once, and notice to nationwide consumer reporting agencies where more than 1,000 persons are notified. These are notifications. The section does not require the data collector to document or keep a record of the breach, of a decision to delay notice, or of any determination, and gives no regulator access to a record. Delay is allowed on a law enforcement request or while the scope of the breach is determined, without any record being required.
- Kind
- None
- As of
What this law does
A data collector that owns or licenses computerized data including personal information must disclose a breach of security to an affected Nevada resident in the most expedient time possible and without unreasonable delay, with no fixed numeric deadline, unlike every other statute in this batch. Consumer-reporting-agency notice is required once more than 1,000 persons are notified at one time; no requirement to notify the Nevada Attorney General appears in the text read.
"Personal information" for breach purposes never includes biometric data, so a biometric-only breach does not trigger this duty. A separate section grants a data collector its own civil action against whoever caused the breach, which is not a consumer's private right of action.
But NRS 603A.260 deems any violation of NRS 603A.010 to 603A.290, which includes this breach duty, a deceptive trade practice under NRS 598.0903 to 598.0999, and NRS 598.0977 gives an elderly or disabled Nevada resident harmed by a deceptive trade practice a standalone civil action for actual and punitive damages and attorney's fees; that route is not excepted for this chapter the way it is for NRS 603A.550's consumer health data chapter.
So a general Nevada resident still has no private right of action for a breach-notification violation, but an elderly or disabled resident does, indirectly, through this deeming-plus-UDAP chain. The section was added by Senate Bill 347 of 2005 (chapter 485, Statutes of Nevada 2005), whose section 24 became effective on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .