Wisconsin breach notice under § 134.98: 45 days, biometric and DNA data, and credit bureaus at 1,000 people

Wisconsin requires notice of unauthorized acquisition of personal information within a reasonable time not exceeding 45 days, counts biometric data and DNA profiles as personal information, and requires nationwide credit bureau notice when 1,000 or more people must be notified.

Source facts

Wisconsin Statute § 134.98 applies to an entity whose principal place of business is in Wisconsin or that maintains or licenses personal information in the state, and to out-of-state entities when a Wisconsin resident’s information is acquired. Personal information includes a name linked to elements such as a financial account number with its code, a DNA profile, or unique biometric data including fingerprint, voice print, retina or iris image.

Notice must be given within a reasonable time, not to exceed 45 days after the entity learns of the acquisition. An entity storing information it does not own, without a contract on the subject, must notify the owner as soon as practicable. If a single incident requires notice to 1,000 or more individuals, the entity must notify all nationwide consumer reporting agencies of the timing, distribution and content of the notices.

Notice is not required if the acquisition does not create a material risk of identity theft or fraud, or if an employee or agent acquired the information in good faith and used it for a lawful purpose of the entity.

Applicability

Use this when an incident may involve Wisconsin residents or data held in Wisconsin. Section 134.97 separately governs disposal of records by financial institutions, medical businesses and tax preparers; confirm other sector rules with counsel.

DSE recommendation

DSE recommends adding Wisconsin’s 45-day limit, its biometric and DNA data elements and its 1,000-person credit bureau trigger to multi-state incident response plans. Include biometric templates from access control and time systems in the data inventory used to scope a breach, document any material-risk conclusion, and make sure storage vendors’ contracts state how quickly they must report to you.

Verification

During the annual exercise, confirm the data inventory lists biometric and DNA data locations, run the 45-day timeline from a simulated discovery date, and check that the credit bureau notice step names an owner.

Official reference

Wisconsin State Legislature — Wis. Stat. § 134.98, Notice of unauthorized acquisition of personal information. Reviewed October 18, 2026.