Michigan breach notice under MCL 445.72: decide, document and notify before the deadline pressure

Michigan’s Identity Theft Protection Act sets who must be notified after a database breach, what each notice must say, and when a vendor must tell the data owner instead. Build those decisions into the response plan before an incident.

Source facts

Under MCL 445.72, a person or agency that owns or licenses data in a database must notify each Michigan resident whose unencrypted and unredacted personal information was accessed and acquired by an unauthorized person, or whose encrypted information was acquired by someone with unauthorized access to the key. Notice is not required if the entity determines, acting with the care of an ordinarily prudent person in a like position, that the breach is not likely to cause substantial loss, injury or identity theft.

An entity that maintains data it does not own or license must notify the owner or licensor instead. Notices must go out without unreasonable delay, which the statute allows only while scope is determined and database integrity restored, or while law enforcement advises that notice would impede an investigation or jeopardize security.

Each notice must describe the breach and the type of personal information involved, say what was done to protect data where applicable, give a telephone number for assistance, and remind recipients to watch for fraud and identity theft. Unless 1,000 or fewer residents are notified, or the entity is subject to 15 USC 6801 to 6809, the nationwide consumer reporting agencies must also be told.

Applicability

Use this for Michigan organizations and their service providers. The statute treats a financial institution following the federal interagency response-program guidance, and an entity complying with HIPAA notice rules, as in compliance, so those organizations should map their existing procedures instead.

DSE recommendation

DSE recommends writing the statute’s decision points into the incident-response plan before an incident. Name who makes and records the likelihood-of-harm determination, require vendors by contract to notify you promptly, keep current postal and email contact data for each customer group, prepare a notice template containing every required element, and assign the consumer-reporting-agency step. Have counsel confirm which other state and federal notice rules apply.

Verification

Run a tabletop exercise that starts with a vendor reporting a database breach. Confirm the decision log records who decided whether notice was required and why, the draft notice contains each required element, and the timeline shows no delay beyond the statute’s permitted reasons.

Official reference

Michigan Legislature — MCL 445.72, Notice of security breach; requirements. Reviewed October 18, 2026.