What is the data breach notification deadline in Florida?

Florida requires notice to affected individuals 30 calendar days from discovery (Fla. Stat. §501.171 (FIPA)).

Do you have to notify the Florida Attorney General of a data breach?

Yes. Florida Dept. of Legal Affairs (AG) must be notified.

← All jurisdictions

FL · data breach notification

Florida

high

Fla. Stat. §501.171 (FIPA)

Individual deadline

30 days

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	30 calendar days from discovery
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Florida Dept. of Legal Affairs (AG), required at 500+ residents; within 30 days Written notice to Dept. of Legal Affairs 15-day extension available for good cause
Credit reporting agencies	Notify CRAs above 1,000 residents.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Penalties	$1,000/day for first 30 days; $50,000 per subsequent 30-day period; cap $500,000 (treated as unfair trade practice)
Notable PI definitions	Includes biometric, geolocation, credentials, medical, health insurance.

Notes

※ Individual notice deadline extendable +15 days for good cause shown to AG

Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Florida breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →