← All jurisdictions
MI · data breach notification
medMichigan
Mich. Comp. Laws §§445.63, 445.72
Individual deadline
No fixed limit
Trigger standard
Any breach
AG / regulator
Not required
| Notice to individuals | in the most expedient time possible and without unreasonable delay |
| Risk-of-harm standard | None, notice required on any qualifying breach of covered personal information. |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | Not required for private-entity breaches. |
| Credit reporting agencies | Notify CRAs above 1,000 residents. |
| Substitute notice | Typically available above $250,000 cost / 500,000 affected (verify). |
| Private right of action | No, enforcement by the state. |
| Penalties | Civil fine $250 per failed notice, aggregate cap $750,000 per breach (commonly cited ≤$250,000 aggregate — verify tier) |
Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a Michigan breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →