Illinois
For Illinois, statute citation is 815 ILCS 530/10; individual notice deadline is in the most expedient time possible and without unreasonable delay; ag notice resident-count trigger is more than 500 Illinois residents; encryption safe harbor is yes; notes is The private-entity rule (§ 10) requires AG notice for breaches affecting more than 500 Illinois residents; notice must be made in the most expedient time possible and without unreasonable delay but no later than when notice is sent to consumers. State agency rule (§ 12) has a separate, stricter requirement: the state agency must notify the AG within 45 days of discovery or when it provides notice to consumers, whichever is sooner. HIPAA-covered entities and business associates that comply with § 50 are exempt from the AG notice requirement in § 10, recorded from its source on 2026-08-18.
- State
- Illinois verified
- Statute citation
- 815 ILCS 530/10 verified
- Individual notice deadline
- in the most expedient time possible and without unreasonable delay verified
- AG notice resident-count trigger
- more than 500 Illinois residents
- Encryption safe harbor
- yes our reading
- Notes
- The private-entity rule (§ 10) requires AG notice for breaches affecting more than 500 Illinois residents; notice must be made in the most expedient time possible and without unreasonable delay but no later than when notice is sent to consumers. State agency rule (§ 12) has a separate, stricter requirement: the state agency must notify the AG within 45 days of discovery or when it provides notice to consumers, whichever is sooner. HIPAA-covered entities and business associates that comply with § 50 are exempt from the AG notice requirement in § 10. our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
(815 ILCS 530/10) Sec. 10. Notice of breach; notice to Attorney General. (a) Any data collector that owns or licenses personal information concerning an Illinois resident shall notify the resident at no charge that there has been a breach of the security of the system data following discovery or notification of the breach. The disclosure notification shall be made in the most expedient time possible and without unreasonable delay,
— ilga.gov, retrieved 2026-08-18
Source
- ilga.govhttps://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=67