United States law applies in MississippiMississippi is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Mississippi, described on this page below, applies here too.
17 of 20 named instruments researched to a stage, across five of the ten areas of law we track: 17 in force. As of .
When each starts15 of 17 carry a date, 2 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
Mississippi's AI-specific enactments split between narrow criminal prohibitions binding private actors and government-facing definitional or study measures that do not.
Two private-facing measures reached the statute book: Senate Bill 2577 (2024) makes it a crime to disseminate an AI-generated election deepfake within 90 days of an election with intent to injure a candidate or influence the result, and House Bill 1308 (2025), enacted primarily to create a child-grooming offense, also amended the state's child-exploitation statute to drop the requirement that a computer-generated or morphed sexual image of a minor depict an identifiable real child.
The remainder of Mississippi's 2025-2026 AI activity is government-facing: House Bill 1723 (2026) codifies a bare statutory definition of artificial intelligence in Title 1, Chapter 3 without imposing any duty; Executive Order 1584 (January 2025) directs state agencies to inventory their AI use and adopt agency AI policies; and Senate Bill 2426 (2025) created a legislative task force to study AI regulation, including a 2026 hearing on whether AI data centers warrant state regulation.
Mississippi's child-exploitation statute already defined a morphed image to include a computer or computer-generated image or picture of sexually explicit conduct created, adapted, or modified to appear to depict a minor engaging in the conduct.
House Bill 1308 (2025), enacted primarily to create a new child-grooming offense, also amended Section 97-5-31 to remove the definition of identifiable child and to remove identifiable child in the definition of child and morphed images, so prosecuting a morphed-image offense no longer requires proof of the specific real-world identity of the depicted minor.
The underlying offenses that reach transporting, selling, and knowingly possessing such a depiction (Section 97-5-33(3) to (5)) are still worded in terms of an actual child, so whether a depiction generated entirely by artificial intelligence, with no real child's likeness involved at all, falls within them is not settled by the statute's text.
A first conviction under Section 97-5-33 is a felony punishable by a fine of $50,000 to $500,000 and imprisonment of 5 to 40 years; a second or subsequent conviction is punishable by a fine of $100,000 to $1,000,000 and imprisonment of 20 years to life. Signed by the Governor , effective .
Makes it a crime to disseminate, or contract to disseminate, a digitization, defined to include an image or audio altered or created using software, machine learning, artificial intelligence or other computer-generated or technological means (a deepfake), within ninety days of an election, without the depicted individual's consent, and with intent to injure a candidate, influence the election result, or deter voting.
A first violation is a misdemeanor; a violation committed with intent to incite violence or bodily harm, to deter voting, or a second or subsequent violation within five years is a more serious offense. Carrying a clear and prominent disclosure throughout the digitization that the depicted individual did not actually engage in the shown speech or conduct is a defense to prosecution. Signed by the Governor .
Mississippi has no comprehensive consumer personal-data statute; two 2025 attempts, SB 2500 and SB 2779, and two 2026 attempts, SB 2015 and HB 1051, all died in committee. Mississippi's sectoral law covers breach notification under Miss.
Code Ann. Section 75-24-29 (HB 583, 2010, in force since and amended in 2021 to add tribal identification card numbers), whose personal information definition has no biometric element and whose enforcement clause deems noncompliance an unfair trade practice while foreclosing a private right of action in the same sentence. In the insurance sector, the Insurance Data Security Law (SB 2831, 2019, in force since , codified at Miss.
Code Ann. Sections 83-5-801 to 83-5-825) names biometric records as a protected nonpublic-information element for insurance licensees but defines the term no further, and likewise expressly forecloses a private cause of action. A dedicated biometric-privacy bill, HB 467 (2023), died in committee. A secondary-source lead describing a Mississippi genetic-testing insurance nondiscrimination provision at Miss. Code Ann. Section 83-9-103 is not independently verified against an official source.
Miss. Code Ann. § 75-24-29(2)-(3)official Mississippi Legislature enrolled act text, as sent to the Governor, billstatus.ls.state.ms.us
In force since .Binds private bodies.
What this law does
A person who conducts business in Mississippi and whose data includes personal information must disclose a breach of security to all affected individuals without unreasonable delay, subject to completing an investigation; notification is not required if the person reasonably determines, after investigation, that the breach will not likely result in harm.
Personal information is an individual's name combined with a Social Security number, a driver's license, state identification card, or tribal identification card number, or an account or credit or debit card number with a required access credential, and excludes publicly available information lawfully made available from government records or widely distributed media; it has no biometric element.
Enacted as HB 583 (2010), effective , and amended by HB 277 (2021, effective ), which added the tribal identification card number as a qualifying element; every other subsection, including the enforcement clause, is unchanged since 2010.
Section 5(4) requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event. The licensee must produce those records upon demand of the commissioner. Section 4(9) requires each insurer domiciled in this state to submit to the commissioner an annual written statement by February 15.
Section 4(9) also requires each insurer to maintain for examination by the department all records, schedules and data supporting the certificate for a period of five years. Section 4(4)(b)(ix) includes audit trails within the information security program, designed to detect and respond to cybersecurity events and to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under the insurance laws of Mississippi. The commissioner has power to examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the act. Section 9(1)(a) exempts a licensee meeting listed size criteria from sections 4, 5(3) and 6(4)(a) and (b) of the act. A violation of the act may be penalized in accordance with section 83-5-85. The act takes effect .
Miss. Code Ann. § 75-24-29(8)official Mississippi Legislature enrolled act text, as sent to the Governor, billstatus.ls.state.ms.us
In force since .Binds private bodies.
What this law does
Failure to comply with Mississippi's breach notification duty constitutes an unfair trade practice enforced by the Attorney General, but the same sentence that deems the violation an unfair trade practice expressly forecloses any private right of action: this closes, in one clause, the exact route that opens a private action in other states whose breach statutes deem a violation an unfair trade practice without an express carve-out.
The Insurance Data Security Law expressly may not be construed to create or imply a private cause of action for its violation, nor to curtail a private cause of action that would otherwise exist absent the law, the same two-part structure as Michigan's parallel statute. The law establishes the exclusive Mississippi standards for a licensee's data security and notification to the Commissioner of Insurance, who enforces it.
Mississippi adopted the NAIC Insurance Data Security Model Law as SB 2831 (2019 Regular Session), signed and effective , codified at Miss. Code Ann. Sections 83-5-801 to 83-5-825.
Nonpublic information (Section 3(k)) includes electronic information that is not publicly available and that, combined with an identifying element, includes a Social Security number, driver's license or nondriver identification card number, financial account or card number, a financial-account access credential, or biometric records.
Biometric records is a bare, undefined term with no elaboration anywhere in Section 3's definitions and no photograph, video, or audio-recording exclusion or clawback clause, the same shape found in Michigan's parallel adoption of the same model law, so whether it excludes a recording-derived identifier cannot be tested against this text. This law binds insurance licensees only, not a general private-sector actor.
Mississippi's computer-misuse statute, the Mississippi Computer Crimes and Identity Theft Act, diverges from the federal Computer Fraud and Abuse Act (CFAA) baseline in two ways favorable to open-web collection.
First, its offenses turn on a specific mental state rather than a bare authorization test: computer fraud requires intent to defraud, and the offenses against computer users, computer equipment, and intellectual property each require acting without the consent of an authorized user or owner, so ordinary access to a page the operator has not restricted does not by itself fit any of the four core offenses.
Second, the Act defines proper means, a defense to the offense against intellectual property, to include observation of the property in public use or on public display, which reaches copying or using information gained by viewing a publicly displayed page. No Mississippi case law applying the Act to a scraping or automated-collection fact pattern was located.
Mississippi has no codified text-and-data-mining exception, sui generis database right, or scraping-specific privacy statute; those questions rest on the federal baseline and on Mississippi's general contract and tort law, and no Mississippi-specific divergence on any of them has been located. robots.txt carries no independent legal weight under Mississippi law, the same gap as the federal baseline.
Computer fraud (Section 97-45-3) is intentionally accessing or causing to be accessed a computer, computer system, or computer network with intent to defraud, to obtain money, property or services by fraudulent means, or to insert malicious code. An offense against computer users (Section 97-45-5) is intentionally denying an authorized user access without consent, or disclosing access codes without consent.
An offense against computer equipment (Section 97-45-7) is intentionally modifying or destroying computer equipment or supplies without consent. An offense against intellectual property (Section 97-45-9) is intentionally destroying, inserting, or modifying intellectual property without consent, or disclosing, using, copying, taking, or accessing it without consent. Section 97-45-9(6) exempts disclosure, use, copying, taking, or accessing by proper means.
Section 97-45-1(v) defines proper means to include observation of the property in public use or on public display, alongside independent invention, lawful reverse engineering, license, and published literature. Each offense escalates through four value-based tiers of fine and imprisonment, with an enhanced Penitentiary term for a third or subsequent conviction. No day on which these sections came into force has been located.
Mississippi has no general reasonable-security, information-security-program, or records-disposal statute of broad private-sector application comparable to New York's SHIELD Act GBL 899-bb, Massachusetts's 201 CMR 17.00, Arkansas's Personal Information Protection Act reasonable-security duty at Ark. Code Ann. section 4-110-104(b), or Vermont's and Hawaii's records-disposal statutes, and no statute setting security requirements a software product or connected device must meet to be placed on the market, comparable to California's or Oregon's connected-device statutes.
Mississippi's breach-notification statute, Miss. Code Ann. section 75-24-29 (as most recently amended by 2021 House Bill 277, Section 9, effective ), applies to any person who conducts business in the state and who, in the ordinary course of the person's business functions, owns, licenses or maintains personal information of a Mississippi resident, and requires only that such a person disclose a breach of security to affected individuals.
Its subsection (7) lets a business that already maintains its own security-breach procedures as part of an information security policy satisfy the statute's notice mechanics through that policy instead, but this substitution clause does not itself impose a duty to adopt such a policy, and subsection (8) provides that failure to comply with the section constitutes an unfair trade practice enforced only by the Attorney General, and that nothing in the section may be construed to create a private right of action.
The statute carries no affirmative safeguards or disposal duty of its own and stays entirely the jurisdiction's privacy-topic row rather than a security instrument here. Two enacted Mississippi statutes impose a genuine information-security-program duty, each on a licensed role, and each is filed as rows of its own. The Mississippi Insurance Data Security Law, Miss.
Code Ann. sections 83-5-801 to 83-5-825, enacted by 2019 Senate Bill 2831 and effective (with a one-year phase-in for the core program duty and a two-year phase-in for the third-party-service-provider due-diligence duty), requires a licensee, defined at section 83-5-805(i) as any person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered pursuant to the insurance laws of the state, excluding an out-of-state-chartered purchasing group or risk-retention group and an out-of-state-domiciled assuming insurer, to develop, implement and maintain a comprehensive written information security program based on a documented risk assessment (section 83-5-807), to investigate a cybersecurity event (section 83-5-809), and to notify the Commissioner of Insurance as promptly as possible but in no event later than three business days from a determination that a qualifying cybersecurity event has occurred (section 83-5-811).
A licensee with fewer than fifty employees, under five million dollars in gross annual revenue, under ten million dollars in year-end total assets, or an insurance producer or adjuster, is exempted from the program, investigation and certain notification duties (section 83-5-817), the Act may not be construed to create or imply a private cause of action for a violation of its provisions (section 83-5-803(2)), and it is enforced instead by the Commissioner and subject to the penalties of section 83-5-85 (section 83-5-819).
Its rows are flagged for an insurer: a developer whose app is not itself an insurance licensee falls outside the Act's scope regardless of which activities it declares.
The second, newly enacted regime is the Data Security for Money Transmitters Act, House Bill 1596 (2026 Regular Session), Sections 1 through 7, in effect from and after (Section 8 of the Act directs its codification in Title 75, Mississippi Code of 1972, without stating the resulting section numbers in the enrolled text); contemporaneous legal-industry reporting states the Governor signed the bill , and its own effective date has already passed as of this reading.
It requires a licensee, defined at Section 2(j) as a money transmitter or virtual currency kiosk licensed under the Money Transmission Modernization Act, Section 75-16-1 et seq., to develop, implement and maintain a comprehensive information security program with administrative, technical and physical safeguards appropriate to its size, complexity and the sensitivity of customer information (Section 3), built on a written risk assessment, a designated qualified individual, access controls, encryption of customer information in transit and at rest, multi-factor authentication, secure development practices, a duty to dispose of customer information securely no later than two years after it was last used in connection with a customer's financial product or service (subject to enumerated exceptions), annual penetration testing, semiannual vulnerability assessments, a written incident response plan, an annual report to the licensee's board of directors, and a written business-continuity and disaster-recovery plan (Section 4), and to notify the Commissioner of Banking and Consumer Finance as soon as possible, but in no event later than seventy-two hours after discovery, of a notification event (the unauthorized acquisition of unencrypted customer information) involving a Mississippi consumer (Section 5).
A licensee holding customer information on fewer than five thousand consumers is exempt from several of these duties (Section 6), and the Act creates no private cause of action.
Licensee under this Act is a person licensed as a money transmitter or virtual currency kiosk operator under Mississippi's Money Transmission Modernization Act, and its rows are flagged for a payment provider and a crypto-asset provider; a developer that offers payment or stored-value functionality inside a broader app is not, by that fact alone, a licensed money transmitter.
On product requirements, no enacted Mississippi statute sets security requirements a connected device or software product must meet before or after it is placed on the market.
On a litigation safe harbor, Mississippi has not enacted one tied to a named cybersecurity framework: House Bill 1380 (2025 Regular Session), sponsored by Representative Hood, and House Bill 1220 (2026 Regular Session), sponsored by Representatives Hood and Hale, both modeled on Ohio's and other states' data-protection safe-harbor acts, would have created a rebuttable presumption against liability in a cybersecurity-incident suit for a covered commercial entity that substantially aligns its cybersecurity program with the National Institute of Standards and Technology (NIST) Cybersecurity Framework or an enumerated federal sectoral standard (Health Insurance Portability and Accountability Act (HIPAA)'s security rule, the Gramm-Leach-Bliley Act, FISMA, or HITECH); the 2026 bill would also have brought forward the Insurance Data Security Law sections for possible amendment.
Each is preserved in the legislative record, so far as located, only as introduced text: no Passed the House or Sent to Governor printing was found for either bill, consistent with contemporaneous legal-industry reporting that HB 1220 did not advance out of committee, so neither reached enactment. On a state cybersecurity framework, Mississippi's Enterprise Security Program, Miss.
Code Ann. section 25-53-201, binds only the state's own agencies and their information-technology procurement, coordinated by the Mississippi Department of Information Technology Services; it sets the state's own internal security and contracting requirements rather than a duty running to a private vendor's own product or service, and its duties on agency heads, with the next-business-day cyberattack and ransomware report added in 2023, are filed as rows of their own with no activity flag.
Mississippi's Computer Crimes and Identity Theft Act, Miss. Code Ann. section 97-45-3, defines offenses committed by an intruder against a computer system or data and is this jurisdiction's scraping-topic material rather than a security-topic duty on an operator or manufacturer. No published enforcement record specific to a security-shaped duty in Mississippi law was located in the sources checked.
The Insurance Data Security Law requires a licensee to develop, implement, and maintain a comprehensive written information security program. The Insurance Data Security Law requires a licensee to notify the commissioner no later than three business days from a determination that a qualifying cybersecurity event has occurred. The Data Security for Money Transmitters Act requires a licensee to develop, implement and maintain a comprehensive information security program.
The Data Security for Money Transmitters Act requires a licensee to notify the commissioner no later than seventy-two hours after discovery of a notification event involving the information of any consumers in Mississippi. Each state agency's executive director or agency head must ensure that an agency-wide security program is in place under the Enterprise Security Program.
All state agencies must notify the Department of Information Technology Services of any cyberattack or demand for payment as a result of ransomware no later than the close of the next business day following the discovery.
The Data Security for Money Transmitters Act defines a licensee as a money transmitter or virtual currency kiosk licensed under the Money Transmission Modernization Act. A licensee shall develop, implement and maintain a comprehensive information security program. A licensee shall designate a qualified individual to be responsible for implementing, overseeing and enforcing its information security program.
A licensee shall protect by encryption all customer information held or transmitted by the licensee, both in transit over external networks and at rest. A licensee shall implement multi-factor authentication for an individual accessing an information system, unless its qualified individual has approved in writing the use of reasonably equivalent or more secure access controls.
A licensee shall develop procedures for the secure disposal of customer information in any format no later than two years after the last date the information was used in connection with the provision of a financial product or service to the customer, subject to three listed exceptions. Absent effective continuous monitoring, a licensee shall conduct annual penetration testing of its information systems.
A licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in its control. The qualified individual shall report in writing, at least annually, to the licensee's board of directors or equivalent governing body.
A licensee that maintains customer information concerning fewer than five thousand consumers is exempt from several of the program duties. The Act takes effect .
The Enterprise Security Program provides for the coordinated oversight of the cybersecurity efforts across all state agencies, including cybersecurity systems, services and the development of policies, standards and guidelines. The Department of Information Technology Services establishes and maintains the security standards and policies for all state data and IT resources that state agencies shall implement to the extent that they apply.
Each state agency's executive director or agency head shall be solely responsible for the security of all data and IT resources under its purview, ensure that an agency-wide security program is in place, and designate an information security officer to administer it. Each agency head shall ensure the agency adheres to the requirements established by the Enterprise Security Program, to the extent that they apply.
Each agency head shall develop, implement and maintain written agency policies and procedures to ensure the security of data and IT resources. Each agency head shall implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and IT resources. Each agency head shall ensure that internal assessments of the security program are conducted.
Each agency head shall participate in annual information security training designed specifically for the executive director or agency head.
The Insurance Data Security Law defines a licensee as any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
Each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment, with administrative, technical and physical safeguards for nonpublic information and the licensee's information system.
Each licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, the licensee's information systems, or the continuing functionality of its business.
Each insurer domiciled in Mississippi shall submit to the commissioner by February 15 each year a written statement certifying that it complies with the information security program section. A licensee with fewer than fifty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets, and insurance producers and adjusters, are exempt from the program section.
Licensees have one year from the effective date to implement the program section and two years to implement its third-party service provider provisions. The Act takes effect . A licensee that violates the Act may be penalized in accordance with section 83-5-85.
A notification event is the acquisition of unencrypted customer information without the authorization of the affected individual. Upon discovery of a notification event involving the information of any consumers in Mississippi, the licensee shall notify the commissioner as soon as possible, but in no event later than seventy-two hours after discovery.
The notice shall be made in a format specified by the commissioner and include six listed items of information, beginning with the name and contact information of the reporting licensee. A law enforcement official may request an initial delay of up to thirty days following the date when notice was provided to the commissioner. A licensee that becomes aware of a notification event in a system maintained by a service provider shall treat the event as it would under the notice subsection.
Each licensee shall notify the commissioner as promptly as possible but in no event later than three business days from a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two criteria is met.
The first criterion is that Mississippi is the licensee's state of domicile, in the case of an insurer, or home state, in the case of a producer, and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of the licensee's normal operations.
The second criterion is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
The licensee shall provide as much as possible of a list of 13 items of information, in electronic form as directed by the commissioner. The licensee has a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information.
A licensee that learns that a cybersecurity event has or may have occurred shall conduct a prompt investigation, or have an outside vendor or service provider designated to act on its behalf conduct one. The licensee shall maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them upon demand of the commissioner.
The licensee shall provide the commissioner a copy of the notice sent to consumers under the state's breach notification statute when it is required to notify the commissioner. A licensee that becomes aware of a cybersecurity event in a system maintained by a third-party service provider shall treat the event as it would under the notification subsection unless the provider gives the commissioner the notice.
An assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of determining that a cybersecurity event has occurred.
A cyberattack is any attempt to gain illegal access, including any data breach, to a computer, computer system or computer network for purposes of causing damage, disruption or harm. From and after , all state agencies shall notify the Department of Information Technology Services of any cyberattack or demand for payment as a result of ransomware no later than the close of the next business day following the discovery.
The Department shall develop a reporting format to be utilized by state agencies to provide the notification. The reports are exempt from the Mississippi Public Records Act of 1983.
Mississippi has an adult content age verification law in effect since 2023, a social media parental consent law that survived a preliminary injunction fight and remains enforceable while a merits appeal is pending, and a 2026 online safety act, signed in April 2026, that treats addictive platform design features as a defective product. No dedicated app store age verification act has passed either chamber.
Requires commercial entities that publish or distribute material harmful to minors, where a substantial portion (more than one third) of the site is such material, to perform reasonable age verification before granting access, using a commercial age verification system or transactional data method.
House Bill 599 of 2025 amended sections 11-77-3 and 11-77-7 of the chapter and added sections 11-77-6 and 11-77-9. House Bill 599 took effect on .
Section 11-77-6 provides that a commercial entity that knowingly and intentionally publishes or distributes obscene matter, or matter that depicts, describes or promotes child pornography or child sexual exploitation, on the Internet may be held liable to an individual for nominal damages, actual damages, noneconomic damages up to $500,000, and court costs and reasonable attorney fees.
Section 11-77-7, as amended, extends the exemption for internet service providers, search engines and cloud service providers to content that is obscene matter or that depicts, describes or promotes child pornography or child sexual exploitation, to the extent the provider is not responsible for creating it.
Prohibits a covered interactive computer service from knowingly making false or misleading statements or representations to a minor, or to a minor's parent or guardian, about the service, such as falsely denying that it is addictive or safe to minors or failing to disclose or warn of its harmful effects. A service with design features that make it addictive to minors is treated as a defective product for state product liability purposes.
A minor's parent or guardian may bring a private action where a knowing and willful violation proximately causes the minor's repeated exposure to material harmful to minors. Signed .
Requires digital service providers that let users socially interact, create profiles, and post content to verify the age of all users and obtain express parental or guardian consent before a known minor (under 18) may hold an account, with default privacy protections for minor accounts.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
Mississippi has no press-publisher neighbouring right, mandatory platform-to-publisher bargaining code, or codified hot-news misappropriation statute distinct from federal copyright law. The Mississippi Code has no title addressing copyright as such, which is occupied by federal law; Title 97's crimes against property, including the Computer Crimes and Identity Theft Act (Miss.
Code Ann. Chapter 45), reach computer fraud and offenses against intellectual property but no provision addressing reproduction of news headlines, snippets, or a text-and-data-mining opt-out. No Mississippi legislative bill proposing a journalism usage fee or a platform-to-publisher payment scheme, and no Mississippi court decision addressing snippet reproduction, linking, framing, or hot-news misappropriation specifically, was located.
Copyright over news content reproduced or aggregated by a service operating in Mississippi is governed by the federal Copyright Act and its fair-use doctrine, already addressed in the federal document for this topic.
As of .
Case law
No current case law for Mississippi AI law
No current case law for Mississippi privacy law
No current case law for Mississippi scraping law
No current case law for Mississippi cybersecurity law
No current case law for Mississippi communications law
No current case law for Mississippi content moderation law
No current case law for Mississippi product and AI liability law
No current case law for Mississippi digital accessibility law
No current case law for Mississippi age gating law
No current case law for Mississippi reuse law
Reporting clocks that run here19 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Mississippi comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the Commissioner of Banking and Consumer Finance as soon as possible, and no later than 72 hours after discovery, of a notification event (the acquisition of unencrypted customer information without the authorization of the affected individual) that involves the information of any consumers in Mississippi, in the format the Commissioner specifies.
Notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Mississippi is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of your normal operations.
Notify the Commissioner within the same three business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
As an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
Disclose a breach of security to all affected Mississippi individuals without unreasonable delay, unless your investigation reasonably determines the breach will not likely result in harm.
The law of the United States, which applies in Mississippi
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
