# Illinois — US state data breach notification deadlines by state

For Illinois, statute citation is 815 ILCS 530/10; individual notice deadline is in the most expedient time possible and without unreasonable delay; ag notice resident-count trigger is more than 500 Illinois residents; encryption safe harbor is yes; notes is The private-entity rule (§ 10) requires AG notice for breaches affecting more than 500 Illinois residents; notice must be made in the most expedient time possible and without unreasonable delay but no later than when notice is sent to consumers. State agency rule (§ 12) has a separate, stricter requirement: the state agency must notify the AG within 45 days of discovery or when it provides notice to consumers, whichever is sooner. HIPAA-covered entities and business associates that comply with § 50 are exempt from the AG notice requirement in § 10, recorded from its source on 2026-08-18.

- **State:** Illinois _(verified: appears in the quote below)_
- **Statute citation:** 815 ILCS 530/10 _(verified: appears in the quote below)_
- **Individual notice deadline:** in the most expedient time possible and without unreasonable delay _(verified: appears in the quote below)_
- **AG notice resident-count trigger:** more than 500 Illinois residents
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** The private-entity rule (§ 10) requires AG notice for breaches affecting more than 500 Illinois residents; notice must be made in the most expedient time possible and without unreasonable delay but no later than when notice is sent to consumers. State agency rule (§ 12) has a separate, stricter requirement: the state agency must notify the AG within 45 days of discovery or when it provides notice to consumers, whichever is sooner. HIPAA-covered entities and business associates that comply with § 50 are exempt from the AG notice requirement in § 10. _(our reading, not quoted from the source)_

## What the source says

> (815 ILCS 530/10) Sec. 10. Notice of breach; notice to Attorney General. (a) Any data collector that owns or licenses personal information concerning an Illinois resident shall notify the resident at no charge that there has been a breach of the security of the system data following discovery or notification of the breach. The disclosure notification shall be made in the most expedient time possible and without unreasonable delay,

## Source

- https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=67

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).