← All jurisdictions
LA · data breach notification
medLouisiana
La. Rev. Stat. §51:3071 et seq.
Individual deadline
60 days
Trigger standard
Risk of harm
AG / regulator
Required
| Notice to individuals | 60 calendar days from discovery |
| Risk-of-harm standard | no notice if, after reasonable investigation, no reasonable likelihood of harm |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | Louisiana Attorney General (Consumer Protection Section), required for any affected resident; within 10 days Written notice to Consumer Protection Section Within 10 days of distribution of notice to residents |
| Credit reporting agencies | No CRA-notice requirement. |
| Substitute notice | Typically available above $250,000 cost / 500,000 affected (verify). |
| Private right of action | Yes. |
| Penalties | Actual damages private action; AG enforcement |
| Notable PI definitions | Includes biometric, passport. |
Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a Louisiana breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →