Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.
\nThe definitions in Illinois’ Personal Information Protection Act say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer.
\nUnder Section 10, a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it.
\nIf a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. Section 45 separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them.
\nUse this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel.
\nDSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you.
\nDuring the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice.
\nIllinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General. Illinois General Assembly — 815 ILCS 530/5, Definitions. Illinois General Assembly — 815 ILCS 530/45, Data security. Reviewed October 18, 2026.
", "content_text": "Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.\nSource facts\nThe definitions in Illinois’ Personal Information Protection Act say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer.\nUnder Section 10, a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it.\nIf a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. Section 45 separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them.\nApplicability\nUse this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel.\nDSE recommendation\nDSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you.\nVerification\nDuring the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice.\nOfficial references\nIllinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General. Illinois General Assembly — 815 ILCS 530/5, Definitions. Illinois General Assembly — 815 ILCS 530/45, Data security. Reviewed October 18, 2026.", "content_markdown": "Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.\n\n## Source facts\n\nThe [definitions in Illinois’ Personal Information Protection Act](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm) say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer.\n\nUnder [Section 10](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm), a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it.\n\nIf a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. [Section 45](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm) separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them.\n\n## Applicability\n\nUse this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel.\n\n## DSE recommendation\n\nDSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you.\n\n## Verification\n\nDuring the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice.\n\n## Official references\n\n[Illinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm). [Illinois General Assembly — 815 ILCS 530/5, Definitions](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm). [Illinois General Assembly — 815 ILCS 530/45, Data security](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/", "url": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule", "item": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/#article", "identifier": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/", "url": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/", "headline": "Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule", "description": "Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible…", "abstract": "Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.", "articleBody": "Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.\nSource facts\nThe definitions in Illinois’ Personal Information Protection Act say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer.\nUnder Section 10, a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it.\nIf a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. Section 45 separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them.\nApplicability\nUse this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel.\nDSE recommendation\nDSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you.\nVerification\nDuring the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice.\nOfficial references\nIllinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General. Illinois General Assembly — 815 ILCS 530/5, Definitions. Illinois General Assembly — 815 ILCS 530/45, Data security. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:39+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Explainer", "Advisory priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 437, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Illinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General", "url": "https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm" } } ] } }