Florida's breach law starts two 30-day clocks at the same moment: the determination of a breach, or reason to believe one occurred. A company must notify affected individuals within 30 days, and the Department of Legal Affairs (the Attorney General's office) too if 500 or more people in Florida are affected. Section 501.171, the Florida Information Protection Act of 2014 (FIPA), covers any commercial entity that acquires, maintains, stores or uses personal information ((1)(b)).
Does the Florida Information Protection Act apply to this incident?
It applies if a covered entity has a "breach of security" involving "personal information" of people in Florida. A breach is "unauthorized access of data in electronic form containing personal information" ((1)(a)). For the notice rules in subsections (3) through (6), governmental entities are covered too ((1)(b)).
- The test is access. California's test asks whether data was acquired. Good-faith access by an employee or agent is not a breach, as long as the information is not used for a purpose unrelated to the business or subject to further unauthorized use ((1)(a)).
- Ransomware without proven exfiltration. Our analysis, not a rule: because the text turns on access, an attacker who reached personal information in your systems may trigger Florida even if you cannot show the data left. Check with counsel before you treat "no exfiltration" as "no breach."
Which data counts as personal information
Subsection (1)(g) has two forms: a first name or first initial and last name combined with one of the elements below, or a user name or email address combined with a password or security question and answer that would permit access to an online account (no name needed).
Element (name plus one of) | Subsection |
|---|---|
Social Security number | (1)(g)1.a.(I) |
Driver license or identification card number, passport number, military identification number, or other similar number on a government document used to verify identity | (1)(g)1.a.(II) |
Financial account number or credit or debit card number, with any required security code, access code or password needed to access the financial account | (1)(g)1.a.(III) |
Any information on medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional | (1)(g)1.a.(IV) |
Health insurance policy number or subscriber identification number and any unique identifier a health insurer uses to identify the individual | (1)(g)1.a.(V) |
Biometric data as defined in section 501.702 (fingerprints, voiceprints, eye retinas or irises, or other unique biological patterns used to identify a person; not photographs, video or audio recordings, or information held for health care treatment, payment or operations under HIPAA) | (1)(g)1.a.(VI) |
Any information about the individual's geolocation | (1)(g)1.a.(VII) |
Chapter 2023-201 added biometric and geolocation data, effective July 1, 2024. Two exclusions apply: information made publicly available by a government entity, and information "encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable" ((1)(g)2.).
Florida's statute has no clause that withdraws the encryption exclusion when the key was also taken. Our analysis: if the key was taken, the data arguably was not "rendered unusable," so do not rely on the exclusion without counsel. The medical and health insurance elements have no HIPAA carve-out; the HIPAA link is the federal-regulator clause below.
When does the clock start?
Both clocks run from "the determination of the breach or reason to believe a breach occurred" (subsections (3)(a) and (4)(a)). The statute defines neither "reason to believe" nor how to count the days, and we found no rule or Attorney General guidance that does. Our analysis, not law:
- Day zero is the first documented moment when credible evidence points to unauthorized access of covered data. An alert is not that moment; a confirmed foothold on a system holding personal information probably is.
- Log the date and the evidence the same day; regulators and opposing counsel will read that entry first.
- Count day 1 as the day after day zero, and confirm the method with counsel.
When must individuals be notified?
Notice to individuals is due "as expeditiously as practicable and without unreasonable delay," and no later than 30 days after the determination ((4)(a)). That period is the outer limit. Notice goes to each person in Florida whose information was, or whom you reasonably believe to have been, accessed.
Three things can move the date:
- Law-enforcement delay. Notice is delayed only on the written request of a law enforcement agency, for the period it says is reasonably necessary. The agency can revoke or extend the delay by a later written request ((4)(b)). A phone call asking you to wait is not enough.
- The 15-day extension. A covered entity "may receive 15 additional days" for the individual notice if good cause for delay is provided in writing to the department within the first 30 days ((3)(a)). The statute does not say whether the department must approve it; our reading is to treat the extra days as unavailable until you have sent the written good cause and, ideally, have an acknowledgment. It does not extend the department notice. Individual notice then runs to 45 days.
- The no-harm waiver, covered in its own section below.
Send notice by mail or email to the address in your records ((4)(d)). State the date, estimated date or estimated date range of the breach; describe the personal information accessed or reasonably believed accessed; and give contact details for questions about the breach and the data you hold on the person ((4)(e)). Substitute notice (a website notice plus print and broadcast media where affected people live) is allowed only if notice would cost more than $250,000, affected individuals exceed 500,000, or you lack mailing or email addresses ((4)(f)).
How to notify the Department of Legal Affairs
If the breach affects 500 or more individuals in Florida, give written notice to the Department of Legal Affairs as expeditiously as practicable and no later than 30 days after the determination ((3)(a)). The threshold is "500 or more," counted in individuals in Florida, not total victims. The 15-day extension does not apply to this notice.
The notice must contain ((3)(b)):
- A synopsis of the events surrounding the breach at the time notice is provided.
- The number of individuals in Florida who were or potentially have been affected.
- Any services related to the breach being offered or scheduled to be offered without charge, and instructions on how to use them.
- A copy of the individual notice, or an explanation of the other actions taken under subsection (4).
- The name, address, telephone number and email address of the employee or agent who can give more information.
The department can also request a police report, incident report or computer forensics report; a copy of your breach policies; and the steps taken to rectify the breach ((3)(c)). You may send supplemental information at any time ((3)(d)).
How to submit. The statute requires only "written notice to the department," and we found no breach-reporting page, form or address from the Attorney General's office. Confirm the intake channel with the office before day 20 and record who you spoke with.
Confidentiality. What the department receives is exempt from public-records requests while an investigation is active, though the department may disclose it in the course of its official duties, to other government bodies, or, to help notify or identify victims, for publication or broadcast (never the items listed in (11)(c)) ((11)(a)-(b)). Afterward, personal information, a computer forensic report and information revealing weaknesses in your data security stay confidential ((11)(c)). That is a public-records exemption, not attorney-client privilege. Our view: brief counsel before the forensic report is written, so you know who will see it and in what form.
How does the no-harm waiver work?
The waiver is a filing. Notice to individuals is not required if, "after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies," the covered entity reasonably determines that the breach "has not and will not likely result in identity theft or any other financial harm" ((4)(c)). The text requires the law-enforcement consultation.
The determination must be documented in writing and kept at least 5 years, and the covered entity must give it to the department within 30 days after the determination. That 30 days runs from the waiver determination, not from reason to believe.
A waiver file should hold:
- the investigation scope, methods and findings, and who ran it;
- the law enforcement agencies consulted, the dates and what they said;
- the reasoning for "no identity theft or financial harm," tied to the data types involved;
- who made the determination and when (that date starts the 30 days);
- proof that the copy reached the department, and a retention date at least 5 years out.
Our view on risk: you must defend the no-harm conclusion after the fact, and ransomware with access to health or financial data is hard to document as "will not likely" cause harm. Where the investigation cannot rule out exfiltration, notify.
How the dates fall: a worked example
A fictional example, using our convention that day 1 is the day after day zero.
Event | Date | Rule |
|---|---|---|
Day zero: reason to believe, logged with evidence | Tue Sept 1 | (3)(a), (4)(a) |
Vendor deadline, if the vendor found the breach and the same day was its day zero | Fri Sept 11 | 10 days, (6)(a) |
Last day to send written good cause for the extension | Thu Oct 1 | (3)(a) |
Department notice due (500 or more Florida individuals) | Thu Oct 1 | 30 days, (3)(a) |
Individual notice due without extension | Thu Oct 1 | 30 days, (4)(a) |
Individual notice due with the extension | Fri Oct 16 | 45 days |
California's Attorney General gets a sample copy of the consumer notice, so that filing follows it (California Attorney General); Texas gives its Attorney General 30 days after discovery (Texas Attorney General). Florida's two clocks start together.
What vendors, consumer reporting agencies and federal regulators change
Third-party agents. A vendor contracted to maintain, store or process personal information for you must tell you of a breach as expeditiously as practicable and no later than 10 days after its own determination or reason to believe ((6)(a)). You then give the notices, and the agent must give you everything you need to do so. An agent may send notices for you, but its failure to give proper notice is deemed a violation against you ((6)(b)). Our reading: if your own evidence supplies reason to believe, your 30 days do not wait for the vendor's 10. Write the 10-day duty and a duty to hand over facts into your vendor incident notification clauses.
Consumer reporting agencies. If you notify more than 1,000 individuals at a single time, also notify all nationwide consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notices ((5)). No day count is given.
Federal-regulator compliance. A covered entity that follows the notice rules of its primary or functional federal regulator is deemed compliant with the individual notice requirement, and with the department notice if it timely sends the department a copy ((4)(g)). The statute gives no day count for "timely"; our analysis is to treat 30 days as the safe reading. Whether HHS counts as a HIPAA-covered entity's "primary or functional federal regulator" is a point to check with counsel.
What does a late notice cost?
A violation of section 501.171 is an unfair or deceptive trade practice when the department sues ((9)(a)). Civil penalties for failing to notify under subsections (3) or (4) are $1,000 for each day up to the first 30 days, then $50,000 for each subsequent 30-day period or portion up to 180 days, and after that an amount not to exceed $500,000 ((9)(b)). They apply per breach, not per individual. Our arithmetic: $30,000 after the first 30 days and up to $280,000 by day 180. The section creates no private cause of action ((10)).
What has changed since 2014
- 2014: FIPA enacted (ch. 2014-189), replacing section 817.5681; effective July 1, 2014.
- 2019: ch. 2019-32 removed the scheduled repeal of the public-records exemption.
- 2023: ch. 2023-201 added biometric data and geolocation, effective July 1, 2024.
- 2026: ch. 2026-52, section 9, deleted "trade secrets" from the public-records exemption's definition of proprietary information. No change to deadlines, thresholds or notice content.
Both 30-day deadlines have been in the statute since it took effect in 2014.
What this page does not cover
The Florida Digital Bill of Rights is about consumer privacy rights; its processor duties point back to section 501.171 for breach notice (section 501.712) rather than setting a clock of their own. Florida also has no cybersecurity safe-harbor statute in force that we found: a 2024 bill (HB 473) that would have shielded entities following a security framework from liability for cybersecurity incidents was vetoed on June 26, 2024, and it is not law.
What to do in order
- Hour 0, incident lead: log the reason-to-believe date, the evidence and who decided. Verify: a dated entry exists.
- Day 1, privacy lead with counsel: estimate Florida individuals affected and the data types involved; check against the 500 and 1,000 thresholds. Verify: a count with a stated confidence level.
- Day 1, vendor manager: ask every involved vendor for its own determination date; its 10 days run from that date. Verify: written answers on file.
- By day 10, counsel: ask any law enforcement agency working the case whether it wants individual notice delayed. A delay exists only if the agency requests it in writing ((4)(b)); without that letter, the 30 days keep running. Separately, decide whether to build a waiver file. Verify: the agency's written request, or the file outline, exists.
- By day 20, privacy lead: confirm the department's intake channel and draft the five-field notice. Decide on the extension; if needed, send the written good cause by day 30 (the statutory last day; earlier is safer). Verify: sent-proof.
- By day 30, privacy lead: send the department notice and the individual notice (day 45 only with an extension in hand); notify the nationwide consumer reporting agencies if above 1,000. Verify: dated copies.
- After, incident lead: add the deadline to your incident response plan and keep any waiver under your retention schedule.
An AI agent can help with steps 1 and 2 by pulling log timestamps for the evidence entry and counting Florida addresses in an affected-data export. A human must set day zero and sign any waiver.
Florida checklist (copy into a ticket)
- [ ] Day zero and its evidence logged ((3)(a), (4)(a))
- [ ] Florida individual count and data elements ((1)(g))
- [ ] Vendor determination dates requested ((6)(a))
- [ ] Written delay request from a law enforcement agency, if the agency made one ((4)(b))
- [ ] Extension good cause sent to the department by day 30 ((3)(a))
- [ ] Individual notice: date range, data description, contact information ((4)(e)); sent by mail or email ((4)(d)); substitute notice only if (4)(f) conditions are met
- [ ] Department notice: synopsis, Florida count, free services, copy of notice, contact ((3)(b))
- [ ] Consumer reporting agencies notified if above 1,000 ((5))
- [ ] If waiving: written determination, law-enforcement consultation, copy to the department within 30 days, 5-year retention ((4)(c))
