Skip to content

Cyber Liability by state

Maine data breach notification law and cyber insurance

Direct answer

What is Maine's data breach notification law?

Maine's breach notification law (Me. Rev. Stat. tit. 10, sect. 1346 et seq.) requires businesses to notify affected residents as expediently as possible and without unreasonable delay, and not later than 30 days after becoming aware of the breach after a breach of personal information.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Maine requires businesses to notify affected residents within 30 days of becoming aware of a breach, along with notice to the appropriate regulator. Cyber liability insurance typically covers the forensics, notification, and legal review this deadline demands.

Consumer notification deadline
As expediently as possible and without unreasonable delay, and not later than 30 days after becoming aware of the breach
Regulator notice
Notify the appropriate state regulator or the Attorney General when residents are notified.
Credit bureau notice
Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.
Safe harbor
Notification is not required if the compromised data was encrypted and the encryption key was not acquired, or where an investigation finds no reasonable likelihood of harm.
Enforcement
Violations are enforceable by the Attorney General, and the statute authorizes civil penalties for each violation subject to a per-day cap.

Statutes and sources

  • Maine Notice of Risk to Personal Data Act

    Me. Rev. Stat. tit. 10, sect. 1346 et seq.

Regulator: Maine Attorney General . Last verified 2026-07-29 from the official source .

Get Maine coverage handled

Share a few details and an agent will respond within one business day.