# Wisconsin — US state data breach notification deadlines by state

For Wisconsin, statute citation is Wis. Stat. § 134.98; individual notice deadline is within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information; individual notice hard deadline (days) is 45; consumer reporting agency notice trigger (residents) is 1,000 or more individuals; encryption safe harbor is yes, recorded from its source on 2026-08-18.

- **State:** Wisconsin _(verified: appears in the quote below)_
- **Statute citation:** Wis. Stat. § 134.98
- **Individual notice deadline:** within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information _(verified: appears in the quote below)_
- **Individual notice hard deadline (days):** 45 _(our reading, not quoted from the source)_
- **Consumer reporting agency notice trigger (residents):** 1,000 or more individuals _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** No AG notification requirement is stated in the statute. GLBA-covered entities in compliance with GLB privacy and security requirements are exempt (subsection 3m(a)). HIPAA-covered entities in compliance with 45 CFR Part 164 are exempt (subsection 3m(b)). CRA notice must be made 'without unreasonable delay' when 1,000 or more individuals are affected. _(our reading, not quoted from the source)_

## What the source says

> 1,000 or more individuals that personal information pertaining to the individuals has been acquired, the entity shall without unreasonable delay notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in <https://docs.legis.wisconsin.gov/document/usc/15%20USC%201681a> 15 USC 1681a (p), of the timing, distribution, and content of the notices sent to the individuals. <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(cm)> 134.98(2)(cm) (cm) Notwithstanding pars. <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(a)> (a) , <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(b)> (b) , <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(bm)> (bm) , and <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(br)> (br) , an entity is not required to provide notice of the acquisition of personal information if any of the following applies: <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(cm)1.> 134.98(2)(cm)1. 1. The acquisition of personal information does not create a material risk of identity theft or fraud to the subject of the personal information. <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)(cm)2.> 134.98(2)(cm)2. 2. The personal information was acquired in good faith by an employee or agent of the entity, if the personal information is used for a lawful purpose of the entity. <https://docs.legis.wisconsin.gov/document/statutes/134.98(3)> 134.98(3) (3) Timing and manner of notice; other requirements. <https://docs.legis.wisconsin.gov/document/statutes/134.98(3)(a)> 134.98(3)(a) (a) Subject to sub. <https://docs.legis.wisconsin.gov/document/statutes/134.98(5)> (5) , an entity shall provide the notice required under sub. <https://docs.legis.wisconsin.gov/document/statutes/134.98(2)> (2) within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information.

## Source

- https://docs.legis.wisconsin.gov/statutes/statutes/134/98

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).