Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.
\nUnder MCL 445.72, a person or agency that owns or licenses data in a database must notify each Michigan resident whose unencrypted and unredacted personal information was accessed and acquired by an unauthorized person, or whose encrypted information was acquired by someone with unauthorized access to the key. Notice is not required if the entity determines, acting with the care of an ordinarily prudent person in a like position, that the breach is not likely to cause substantial loss, injury or identity theft.
\nAn entity that maintains data it does not own or license must notify the owner or licensor instead. Notices must go out without unreasonable delay, which the statute allows only while scope is determined and database integrity restored, or while law enforcement advises that notice would impede an investigation or jeopardize security.
\nEach notice must describe the breach and the type of personal information involved, say what was done to protect data where applicable, give a telephone number for assistance, and remind recipients to watch for fraud and identity theft. Unless 1,000 or fewer residents are notified, or the entity is subject to 15 USC 6801 to 6809, the nationwide consumer reporting agencies must also be told.
\nUse this for Michigan organizations and their service providers. The statute treats a financial institution following the federal interagency response-program guidance, and an entity complying with HIPAA notice rules, as in compliance, so those organizations should map their existing procedures instead.
\nDSE recommends writing the statute’s decision points into the incident-response plan before an incident. Name who makes and records the likelihood-of-harm determination, require vendors by contract to notify you promptly, keep current postal and email contact data for each customer group, prepare a notice template containing every required element, and assign the consumer-reporting-agency step. Have counsel confirm which other state and federal notice rules apply.
\nRun a tabletop exercise that starts with a vendor reporting a database breach. Confirm the decision log records who decided whether notice was required and why, the draft notice contains each required element, and the timeline shows no delay beyond the statute’s permitted reasons.
\nMichigan Legislature — MCL 445.72, Notice of security breach; requirements. Reviewed October 18, 2026.
", "content_text": "Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.\nSource facts\nUnder MCL 445.72, a person or agency that owns or licenses data in a database must notify each Michigan resident whose unencrypted and unredacted personal information was accessed and acquired by an unauthorized person, or whose encrypted information was acquired by someone with unauthorized access to the key. Notice is not required if the entity determines, acting with the care of an ordinarily prudent person in a like position, that the breach is not likely to cause substantial loss, injury or identity theft.\nAn entity that maintains data it does not own or license must notify the owner or licensor instead. Notices must go out without unreasonable delay, which the statute allows only while scope is determined and database integrity restored, or while law enforcement advises that notice would impede an investigation or jeopardize security.\nEach notice must describe the breach and the type of personal information involved, say what was done to protect data where applicable, give a telephone number for assistance, and remind recipients to watch for fraud and identity theft. Unless 1,000 or fewer residents are notified, or the entity is subject to 15 USC 6801 to 6809, the nationwide consumer reporting agencies must also be told.\nApplicability\nUse this for Michigan organizations and their service providers. The statute treats a financial institution following the federal interagency response-program guidance, and an entity complying with HIPAA notice rules, as in compliance, so those organizations should map their existing procedures instead.\nDSE recommendation\nDSE recommends writing the statute’s decision points into the incident-response plan before an incident. Name who makes and records the likelihood-of-harm determination, require vendors by contract to notify you promptly, keep current postal and email contact data for each customer group, prepare a notice template containing every required element, and assign the consumer-reporting-agency step. Have counsel confirm which other state and federal notice rules apply.\nVerification\nRun a tabletop exercise that starts with a vendor reporting a database breach. Confirm the decision log records who decided whether notice was required and why, the draft notice contains each required element, and the timeline shows no delay beyond the statute’s permitted reasons.\nOfficial reference\nMichigan Legislature — MCL 445.72, Notice of security breach; requirements. Reviewed October 18, 2026.", "content_markdown": "Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.\n\n## Source facts\n\nUnder [MCL 445.72](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72), a person or agency that owns or licenses data in a database must notify each Michigan resident whose unencrypted and unredacted personal information was accessed and acquired by an unauthorized person, or whose encrypted information was acquired by someone with unauthorized access to the key. Notice is not required if the entity determines, acting with the care of an ordinarily prudent person in a like position, that the breach is not likely to cause substantial loss, injury or identity theft.\n\nAn entity that maintains data it does not own or license must notify the owner or licensor instead. Notices must go out without unreasonable delay, which the statute allows only while scope is determined and database integrity restored, or while law enforcement advises that notice would impede an investigation or jeopardize security.\n\nEach notice must describe the breach and the type of personal information involved, say what was done to protect data where applicable, give a telephone number for assistance, and remind recipients to watch for fraud and identity theft. Unless 1,000 or fewer residents are notified, or the entity is subject to 15 USC 6801 to 6809, the nationwide consumer reporting agencies must also be told.\n\n## Applicability\n\nUse this for Michigan organizations and their service providers. The statute treats a financial institution following the federal interagency response-program guidance, and an entity complying with HIPAA notice rules, as in compliance, so those organizations should map their existing procedures instead.\n\n## DSE recommendation\n\nDSE recommends writing the statute’s decision points into the incident-response plan before an incident. Name who makes and records the likelihood-of-harm determination, require vendors by contract to notify you promptly, keep current postal and email contact data for each customer group, prepare a notice template containing every required element, and assign the consumer-reporting-agency step. Have counsel confirm which other state and federal notice rules apply.\n\n## Verification\n\nRun a tabletop exercise that starts with a vendor reporting a database breach. Confirm the decision log records who decided whether notice was required and why, the draft notice contains each required element, and the timeline shows no delay beyond the statute’s permitted reasons.\n\n## Official reference\n\n[Michigan Legislature — MCL 445.72, Notice of security breach; requirements](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/", "url": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Michigan breach notice under MCL 445.72: decide, document and notify before the deadline pressure", "item": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/#article", "identifier": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/", "url": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/", "headline": "Michigan breach notice under MCL 445.72: decide, document and notify before the deadline pressure", "description": "Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the…", "abstract": "Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.", "articleBody": "Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.\nSource facts\nUnder MCL 445.72, a person or agency that owns or licenses data in a database must notify each Michigan resident whose unencrypted and unredacted personal information was accessed and acquired by an unauthorized person, or whose encrypted information was acquired by someone with unauthorized access to the key. Notice is not required if the entity determines, acting with the care of an ordinarily prudent person in a like position, that the breach is not likely to cause substantial loss, injury or identity theft.\nAn entity that maintains data it does not own or license must notify the owner or licensor instead. Notices must go out without unreasonable delay, which the statute allows only while scope is determined and database integrity restored, or while law enforcement advises that notice would impede an investigation or jeopardize security.\nEach notice must describe the breach and the type of personal information involved, say what was done to protect data where applicable, give a telephone number for assistance, and remind recipients to watch for fraud and identity theft. Unless 1,000 or fewer residents are notified, or the entity is subject to 15 USC 6801 to 6809, the nationwide consumer reporting agencies must also be told.\nApplicability\nUse this for Michigan organizations and their service providers. The statute treats a financial institution following the federal interagency response-program guidance, and an entity complying with HIPAA notice rules, as in compliance, so those organizations should map their existing procedures instead.\nDSE recommendation\nDSE recommends writing the statute’s decision points into the incident-response plan before an incident. Name who makes and records the likelihood-of-harm determination, require vendors by contract to notify you promptly, keep current postal and email contact data for each customer group, prepare a notice template containing every required element, and assign the consumer-reporting-agency step. Have counsel confirm which other state and federal notice rules apply.\nVerification\nRun a tabletop exercise that starts with a vendor reporting a database breach. Confirm the decision log records who decided whether notice was required and why, the draft notice contains each required element, and the timeline shows no delay beyond the statute’s permitted reasons.\nOfficial reference\nMichigan Legislature — MCL 445.72, Notice of security breach; requirements. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:01+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/michigan-identity-theft-protection-act-breach-notice-mcl-445-72/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Michigan breach notice under MCL 445.72: decide, document and notify before the deadline pressure" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Playbook", "Advisory priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 405, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Michigan Legislature — MCL 445.72, Notice of security breach; requirements", "url": "https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-445-72" } } ] } }