Louisiana

As part of a broad, Louisiana State Law Institute-recommended revision of the Code of Civil Procedure, Article 371 was amended to add that an attorney shall not knowingly encourage or produce false evidence, including evidence that is artificially generated or altered by any means, and shall exercise reasonable diligence to verify the authenticity of evidence before offering it to a court.

Offering evidence that the attorney knew or should have known through reasonable diligence was false or artificially manipulated, without disclosing that fact, is a violation of the Article, subjecting the attorney to punishment for contempt of court and other professional discipline. Signed by Governor Landry on June 11, 2025 as Act 250 (House Bill 178) and in effect since August 1, 2025.

Louisiana's pre-existing Database Security Breach Notification Law (La. R.S. 51:3071 to 51:3077), first enacted 2005 (effective January 1, 2006) and last substantively amended 2018, is independent of the LDPA and already in force.

Personal information is an individual's name combined with a Social Security number, driver's license or state ID number, financial account or card number with an access code, passport number, or biometric data used to uniquely authenticate identity when accessing a system or account (a narrower, authentication-scoped biometric definition than the LDPA's, with no recording-derived exclusion or clawback of its own), and excludes publicly available government-record information.

Notice to affected Louisiana residents is required in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery, with written reasons for any delay owed to the Attorney General. No notice at all is required if, after investigation, there is no reasonable likelihood of harm, subject to a five-year document-retention duty for that determination.

The Louisiana Data Privacy Act, enacted as Act No. 502 of the 2026 Regular Session (formerly SB 386) and signed by Governor Landry on May 29, 2026, applies to a person or entity doing business in Louisiana that meets any one of three independent thresholds: annual gross revenue exceeding $25 million, annually buying, receiving, selling, or sharing for commercial purposes the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenue from selling personal data.

Exemptions include state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, nonprofits, higher-education institutions, and Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates, plus a separate household or personal-activity carve-out. Controllers and processors carry General Data Protection Regulation (GDPR) and VCDPA-style duties, including data protection assessments, processor contracts, and purpose limitation, under Sec. 1780.4. The Act takes effect January 1, 2027.

The LDPA gives a Louisiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale of personal data, and profiling producing a legal or similarly significant effect.

A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available if the controller notifies the consumer of the extension and its reason within the initial period. An appeal of a denial must be answered within 60 days, and a denial must include an online mechanism to reach the Attorney General. Any contract provision waiving or limiting a consumer's rights under this section is void and unenforceable as against public policy.

A violation of the Database Security Breach Notification Law is deemed an unfair act or practice under R.S. 51:1405(A), with no carve-out of the Unfair Trade Practices and Consumer Protection Law's own private-action provision. This is the opposite private-right-of-action answer from the LDPA in the same title of the same code: the LDPA expressly excludes R.S. 51:1409 and 1409.1, while this breach statute's deeming clause carries no such exclusion.

The specific amendment that added subsection (J)'s deeming clause is not independently dated, so no effective date is recorded for this instrument beyond the statute's current codified text.

The Louisiana Attorney General has exclusive authority to enforce the LDPA. A violation constitutes an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law (UTPCPL), R.S. 51:1401 et seq., but the Act expressly excludes the UTPCPL's own private-action provisions, R.S. 51:1409 and 1409.1, foreclosing a private right of action under the LDPA.

From January 1 to July 31, 2027, before bringing an action the Attorney General must give a person 30 days' written notice identifying the specific provisions violated, and may not initiate an investigation if the person cures the violation and confirms the cure in writing within that period.

R.S. 51:1409(A) lets any person who suffers an ascertainable loss from an unfair or deceptive practice declared unlawful by R.S. 51:1405 bring an individual action for actual damages, trebled if the practice was knowingly used after Attorney General notice, plus attorney fees and costs.

Because the Database Security Breach Notification Law's own deeming clause, R.S. 51:3074(J), routes a breach-notice violation into R.S. 51:1405(A) without excluding this section, a Louisiana resident harmed by a breach-notice violation can sue directly under this provision.

Sensitive data under the LDPA includes personal data revealing racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; a known child's personal data; and precise geolocation data.

Biometric data means data generated by automatic measurement of an individual's biological characteristics used to identify a specific individual, such as a fingerprint, voiceprint, or eye retina or iris scan.

The definition excludes a physical or digital photograph, or data generated from a photograph, video, or audio recording, but claws that exclusion back whenever the data is generated to identify a specific individual, so a voiceprint or faceprint deliberately extracted from a recording for identification purposes remains biometric and sensitive data regardless of the recording's own origin or public status.

A person selling sensitive data under the Act's revenue-from-sale applicability threshold must first obtain the consumer's consent.

Computer tampering under R.S. 14:73.7 is the intentional, knowing commission, without the authorization of the owner of a computer, of accessing or causing to be accessed a computer or any part of it, copying or otherwise obtaining a program or data, damaging or destroying a computer or its data, or introducing electronic information with the intent to damage or destroy.

Actions taken without authorization expressly include actions that intentionally exceed the limits of authorization, and using a confidential or proprietary access code that was not issued to the person creates a rebuttable presumption that the access was unauthorized or exceeded authorization.

Penalties are tiered: access or copying alone (paragraphs (A)(1) and (2)) is punishable by a fine of not more than five hundred dollars, imprisonment for not more than six months, or both; damage or destruction (paragraphs (A)(3) and (4)) by a fine of not more than ten thousand dollars, imprisonment with or without hard labor for not more than five years, or both; and damage or destruction intended to disrupt vital state, local, or utility services, or to cause death or great bodily harm, by a fine of not more than ten thousand dollars, imprisonment at hard labor for not more than fifteen years, or both.

Enacted by Acts 2001, No. 829, section 1.

Any person that conducts business in Louisiana, or any person or agency that owns or licenses computerized data including personal information, must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure, and must take all reasonable steps to destroy or arrange for the destruction of records containing personal information no longer to be retained.

Because the same chapter's deeming clause, R.S. 51:3074(J), reaches a violation of this safeguards duty exactly as it reaches the chapter's breach-notice duty, and carries no exclusion of R.S. 51:1409, a Louisiana resident harmed by a violation can bring a private action for actual damages, trebled if the violation was knowing after Attorney General notice, plus attorney fees and costs.

Commercial entities whose websites contain a substantial portion (one third or more) of material harmful to minors must perform reasonable age verification of Louisiana visitors. A 2024 amendment added Attorney General enforcement alongside the original private right of action.