Breach notification and data security laws by state

Bills that moved most recently

The 25 open breach notification and data security bills with the latest action. The Cybersecurity Legislation Tracker follows all 80.

• 13 October 2026

  Congress H.R. 10238: Cybersecurity for Small Businesses Act of 2026

  What it would do: Requires the Small Business Administration Administrator to develop and disseminate cybersecurity information and resources to small businesses, including compliance information for federal contracting, in consultation with relevant federal agencies.

  Passed committee

• 5 October 2026

  Congress S. 3315: Health Care Cybersecurity and Resiliency Act of 2026

  What it would do: Requires the HHS Secretary and CISA Director to coordinate on healthcare cybersecurity; mandates HHS develop a cybersecurity incident response plan within one year; updates breach reporting requirements; establishes minimum cybersecurity standards including multifactor authentication and encryption; authorizes grants for eligible health entities to adopt cybersecurity best practices through fiscal year 2030.

  Passed chamber

• 29 June 2026

  District of Columbia B 26-0670: District of Columbia Government Data Privacy and Protection Act of 2026

  What it would do: Establishes comprehensive privacy protections for District government agencies handling personal data of covered individuals, creates a Chief Privacy Officer position within OCTO to oversee compliance, and grants individuals rights to access, correct, and delete their personal data.

  In committee

• 8 June 2026

  Congress S. 4699: Guaranteeing Universal Access to Cybersecurity Act

  In committee

• 4 June 2026

  New York S 9088: Requires the registration of data brokers and establishing a data deletion mechanism for consumers

  What it would do: Requires data brokers to register with the New York attorney general and establish a mechanism allowing consumers to request deletion of their personal information from all registered data brokers through a single request.

  Passed chamber

• 1 June 2026

  New York S 8169: Requires all state entities to notify affected individuals in the event of a data breach where information is compromised

  What it would do: Requires state entities to notify New York residents without unreasonable delay when their private information is breached, and defines breach to include unauthorized acquisition, access, or utilization of computerized data compromising security, confidentiality, or integrity.

  Passed chamber

• 6 April 2026

  Oklahoma SB 1716: Security Breach Notification Act; prohibiting class action liability for private entity for cybersecurity event; providing exceptions. Effective date.

  What it would do: Amends the Security Breach Notification Act by adding definitions and clarifying applicability to controllers and processors of personal data meeting specified thresholds, while exempting state agencies, financial institutions, covered entities under HIPAA, nonprofits, institutions of higher education, and certain other entities. Effective January 1, 2027.

  Passed chamber

• 20 March 2026

  Congress H.R. 7316: SNAP Payment Security and Fraud Prevention Act of 2026

  In committee

• 10 March 2026

  New York S 3078: Relates to credit monitoring services

  What it would do: Requires that when a person or business notifies someone of a security breach, if the notifying entity was the breach source, it must offer identity theft prevention and mitigation services at no cost for at least twelve months.

  Passed chamber

• 3 March 2026

  Mississippi HB 1220: Cybersecurity; governmental and certain commercial entities substantially complying with standards not liable for incidents relating to.

  What it would do: Provides immunity from cybersecurity incident liability for state and local governmental entities adopting nationally-recognized cybersecurity standards, and creates a rebuttable presumption against liability for covered commercial entities substantially complying with specified cybersecurity frameworks or federal security requirements.

  Passed chamber

• 25 February 2026

  New York S 1961: Establishes the "secure our data act"

  What it would do: Requires state entities to implement cybersecurity protections for personal information, including immutable backups in segmented storage, vulnerability assessments, incident response plans, and annual workforce training, with regulations to be promulgated within one year.

  Passed chamber

• 20 February 2026

  Hawaii SB 3015: Relating to personal information.

  What it would do: Prohibits Hawaii government entities from making personal information publicly accessible through websites, databases, or similar systems unless explicitly required by law, and requires entities to implement security procedures, respond to individual notices within 30 days, and report breaches to affected residents.

  Passed chamber

• 19 February 2026

  New Jersey A 4093: Requires certain persons and business entities to maintain comprehensive information security program.

  What it would do: Requires any person or business entity that owns or licenses personal information about New Jersey residents to develop, implement, and maintain a comprehensive information security program with administrative, technical, and physical safeguards. Violations are unlawful practices under the consumer fraud act.

  In committee

• 16 February 2026

  Iowa HF 2452: A bill for an act establishing the data security program within the department of education, and making appropriations.

  What it would do: Establishes a data security program within the department of education allowing school districts to voluntarily participate in selected data security services, and appropriates $250,000 to a data security program fund for fiscal year 2026-2027.

  In committee

• 11 February 2026

  Michigan SB 549: Insurance: other; data security enforcement; modify. Amends secs. 553, 561 & 563 of 1956 PA 218 (MCL 500.553 et seq.) & adds secs. 564 & 564a.

  What it would do: Amends Michigan's insurance data security law to define key terms like cybersecurity events, nonpublic information, and multi-factor authentication. Establishes requirements for licensees to notify affected residents and consumer reporting agencies of data breaches, with civil penalties up to $250 per violation and aggregate liability capped at $750,000 per event.

  Passed committee

• 5 February 2026

  New York S 9131: Relates to data broker regulation

  What it would do: Creates Article 42-A regulating data brokers in New York, requiring them to implement comprehensive information security programs, register annually with the attorney general for $100,000, and prohibiting acquisition of personally identifiable information through fraudulent means or for stalking, fraud, or discrimination.

  In committee

• 3 February 2026

  Mississippi SB 2128: Breach of security; report to the Attorney General.

  What it would do: Requires entities conducting business in Mississippi that maintain personal information of state residents to notify affected individuals of security breaches without unreasonable delay, and to notify the Attorney General in writing if more than 100 individuals are affected.

  In committee

• 3 February 2026

  Mississippi SB 2410: Cybersecurity; limit liability for governmental and certain commercial entities that substantially comply with standards.

  What it would do: Provides liability protection for governmental entities and commercial entities that substantially comply with specified cybersecurity standards including NIST frameworks, CIS controls, and ISO/IEC 27000 standards, with a rebuttable presumption against liability for covered entities meeting these requirements.

  In committee

• 27 January 2026

  Congress H.R. 7270: Stop Identity Fraud and Identity Theft Act of 2026

  In committee

• 13 January 2026

  New Jersey A 1550: Requires adoption and implementation of cybersecurity standards by casinos and sportsbooks; establishes safe gaming certification program.

  What it would do: Requires casino and sports wagering licensees and their contracted operators to establish cybersecurity programs complying with NIST or ISO 27000 standards, conduct annual independent audits, and report breaches within 72 hours. Establishes a safe gaming certification program with a three-year validity period.

  In committee

• 13 January 2026

  New Jersey A 3283: Requires businesses in financial, essential infrastructure, and health care industries to develop cybersecurity plans.

  What it would do: Requires businesses in financial, essential infrastructure, and healthcare industries to develop and implement cybersecurity programs conforming to industry-recognized frameworks, submit plans to the New Jersey Cybersecurity and Communications Integration Cell, and annually certify compliance.

  In committee

• 7 January 2026

  New York A 1239: Requires policies covering losses or damages from cyberattacks to include a requirement that the insured notify a law enforcement agency

  What it would do: Requires insurance policies covering cyberattack losses or damages for corporations or business entities to mandate that the insured notify a law enforcement agency before receiving payment for such losses or damages.

  In committee

• 7 January 2026

  New York A 1374: Relates to identity theft prevention and mitigation services in the case of a security breach

  What it would do: Requires persons or businesses experiencing a security breach involving social security numbers to offer affected New York residents at least 24 months of free credit monitoring, identity theft prevention, and mitigation services, with a financial hardship exemption available for individual persons and small businesses.

  In committee

• 7 January 2026

  New York A 7719: Establishes a commission to study cyber security in the state

  What it would do: Establishes an 11-member commission to study cyber security and the EU's general data protection regulation, develop protective legislation, and make recommendations for safeguarding critical infrastructure, financial systems, and other sectors. Requires a report to the governor and legislature within one year.

  In committee

• 7 January 2026

  New York S 4427: Relates to a business tax credit for purchase of data breach insurance

  What it would do: Allows businesses with 100 or fewer employees a tax credit equal to 25 percent of data breach insurance premiums paid, provided they adopt cybersecurity standards from NIST or the state comptroller. Credit expires five years after enactment.

  In committee