# Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule > Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected. - Canonical URL: https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:39+00:00 - Modified: 2026-10-18T22:22:07+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Explainer - DSE priority: Advisory - Topics: Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected. ## Potentially affected Businesses, schools, health and financial organizations and service providers that hold personal information about Illinois residents, including vendors that store data on a client’s behalf. ## DSE recommendation DSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. ## Article Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected. ## Source facts The [definitions in Illinois’ Personal Information Protection Act](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm) say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer. Under [Section 10](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm), a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it. If a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. [Section 45](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm) separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them. ## Applicability Use this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel. ## DSE recommendation DSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you. ## Verification During the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice. ## Official references [Illinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm). [Illinois General Assembly — 815 ILCS 530/5, Definitions](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm). [Illinois General Assembly — 815 ILCS 530/45, Data security](https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm). Reviewed October 18, 2026. ## Primary reference - Name: Illinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General - Authority: www.ilga.gov - URL: https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule,” DSE Security, https://update.dsesecurity.com/updates/illinois-pipa-815-ilcs-530-breach-notice-attorney-general-500/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.