Pennsylvania data breach notification law and cyber insurance

What the statute requires

Pennsylvania requires businesses to notify affected residents of breaches of unencrypted personal information without unreasonable delay, with Attorney General notice above 500 residents. Cyber liability insurance typically covers the forensics, notification, and legal review this statute drives.

Consumer notification deadline

Without unreasonable delay

Regulator notice

Notify the Pennsylvania Office of Attorney General when a breach affects more than 500 residents.

Credit bureau notice

Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.

Safe harbor

Notification is not required if the compromised data was encrypted or redacted and the encryption key was not acquired.

Enforcement

Violations are unfair or deceptive practices enforceable by the Attorney General under the state's consumer protection law.

Statutes and sources

• Pennsylvania Breach of Personal Information Notification Act

  73 Pa. Stat. sect. 2301 et seq.

Regulator: Pennsylvania Office of Attorney General . Last verified 2026-07-29 from the official source .

Cyber Liability in other states

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• District of Columbia
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Indiana
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• New York
• North Carolina
• North Dakota
• Ohio
• Oklahoma
• Oregon
• Rhode Island
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• Vermont
• Virginia
• Washington
• West Virginia
• Wisconsin
• Wyoming

Back to the cyber liability coverage guide