Illinois breach notice under PIPA: covered data, notice content and the 500-resident Attorney General rule

Illinois’ Personal Information Protection Act requires data collectors to notify affected Illinois residents in the most expedient time possible, covers medical, health insurance and biometric data as well as financial identifiers, and adds Attorney General notice when more than 500 residents are affected.

Source facts

The definitions in Illinois’ Personal Information Protection Act say a data collector includes government agencies, universities, corporations, financial institutions, retail operators and any other entity that handles nonpublic personal information. Covered data includes a name combined with a Social Security, driver’s license or account number, medical information, health insurance information, or biometric data such as a fingerprint, retina or iris image, as well as a username or email address with a password or security answer.

Under Section 10, a data collector that owns or licenses the data must notify affected Illinois residents at no charge in the most expedient time possible and without unreasonable delay. For financial-identifier breaches, the notice must include the toll-free numbers and addresses of consumer reporting agencies and the FTC’s contact information. A collector that only maintains data for someone else must notify the owner immediately following discovery and cooperate with it.

If a single breach requires notice to more than 500 Illinois residents, the data collector must also notify the Attorney General, no later than it notifies consumers, describing the breach, the number of residents affected and its response steps. Section 45 separately requires reasonable security measures, and contracts that disclose personal information must require the recipient to maintain them.

Applicability

Use this when an incident may involve Illinois residents, regardless of where the organization is based. HIPAA-covered entities and business associates that comply with the Act’s HIPAA provisions are handled differently for the Attorney General notice; confirm specifics with counsel.

DSE recommendation

DSE recommends adding Illinois’ data elements, notice content and 500-resident Attorney General trigger to the incident response plan for any organization with Illinois residents’ data. Tag records by state of residence so counts can be produced quickly, keep a draft notice with the required consumer reporting agency and FTC contacts, and make sure vendor contracts require both reasonable security and immediate notice to you.

Verification

During the annual incident exercise, produce a count of Illinois residents from a sample dataset within the time the plan allows, check the draft notice against the Act’s content list, and confirm that each vendor holding Illinois residents’ data has a contract clause for security and immediate breach notice.

Official references

Illinois General Assembly — 815 ILCS 530/10, Personal Information Protection Act: Notice of breach; notice to Attorney General. Illinois General Assembly — 815 ILCS 530/5, Definitions. Illinois General Assembly — 815 ILCS 530/45, Data security. Reviewed October 18, 2026.