Pennsylvania Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Pennsylvania's Breach of Personal Information Notification Act, codified at 73 Pa. Stat. 2301 et seq., requires businesses to notify affected residents of a data breach without unreasonable delay. The law sets no fixed-day deadline, and the 2024 Act 33 amendment added Attorney General notification and mandatory credit monitoring requirements.

Pennsylvania's data breach notification requirements received a significant update in 2024 when Governor Josh Shapiro signed Act 33 of 2024 into law on June 28, 2024, effective September 26, 2024. The amended Breach of Personal Information Notification Act (BPINA), codified at 73 Pa. Stat. 2301 et seq., now requires Attorney General notification, mandates 12-month credit monitoring for certain breaches, and narrows the medical information trigger to state agencies and their contractors. Health insurance data and online account credentials became covered personal information earlier, under Act 151 of 2022.

This guide covers the full scope of Pennsylvania's breach notification requirements as amended, including what personal information triggers the law, who must be notified, the timeline, enforcement penalties, exemptions, and how the law connects to the state's broader data privacy framework.

Who Must Comply With Pennsylvania's Breach Notification Law

BPINA applies to any entity that maintains, stores, or manages computerized data that includes personal information. The law covers both public entities (state agencies, counties, municipalities, school districts) and private entities (corporations, partnerships, sole proprietors, and any other form of business).

The law distinguishes between entities that maintain their own data and those that maintain data on behalf of another entity. A third-party vendor that discovers a breach of data it maintains for another entity must notify the data owner. The data owner then carries the primary obligation to notify affected consumers and regulators.

Out-of-state businesses that maintain personal information belonging to Pennsylvania residents are subject to the law.

What Qualifies as a Breach of Security

Under BPINA, a breach of the security of the system means the unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals.

The "materially compromises" threshold means that not every unauthorized access automatically triggers notification. The entity must determine whether the breach actually affected the security or confidentiality of the data.

Good Faith Exception

A good faith acquisition of personal information by an employee or agent of the entity for the purposes of the entity is not a breach of the security of the system, provided the personal information is not used for an unauthorized purpose or subject to further unauthorized disclosure.

The Encryption Safe Harbor

BPINA provides a safe harbor for encrypted data, but with an important caveat. Encrypted data is exempt from notification requirements unless the encryption key or process was accessed or acquired during the breach, or the breach was committed by a person who had access to the encryption key. If either condition applies, the safe harbor does not protect the entity and full notification is required.

What Personal Information Triggers the Law

The 2024 amendment expanded BPINA's definition of personal information. Under the current law, personal information means an individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements when the elements are not encrypted or redacted:

• Social Security number
• Driver's license number or state identification card number
• Financial account number, credit or debit card number, in combination with any required security code, access code, or password
• Health insurance information (policy number or subscriber ID in combination with an access code or medical information permitting misuse of health insurance benefits) (added by Act 151 of 2022)
• Medical information in the possession of a state agency or state agency contractor (narrowed to government entities by Act 33)
• Username or email address in combination with a password or security question and answer that would permit access to an online account (added by Act 151 of 2022)

The health insurance and online account credential additions align Pennsylvania with the growing trend of states broadening their breach notification triggers beyond the traditional SSN/DL/financial account trio.

Note: The medical information trigger was narrowed by Act 33 to apply only when the information is in the possession of a state agency or state agency contractor. Private sector entities are not required to notify for breaches of medical information unless they are government contractors.

Notification Timeline

Pennsylvania does not impose a fixed deadline measured in days. BPINA requires notification "without unreasonable delay." Delays are permitted when:

• Consistent with the legitimate needs of law enforcement
• Necessary to take any measures to determine the scope of the breach and to restore the reasonable integrity of the data system

Law enforcement may request a delay by providing the entity with a written request. The entity may delay notification during the period specified by law enforcement.

Who Must Be Notified

Affected Individuals

Every Pennsylvania resident whose personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person must receive notification. The notice must include:

• A description of the incident in general terms
• The type of personal information subject to the breach
• Steps the entity has taken to address the breach
• Contact information for the entity providing notice
• Contact information for major credit reporting agencies

Attorney General

Under the 2024 amendment, the Pennsylvania Attorney General must be notified concurrently with the affected-resident notice when a breach affects more than 500 Pennsylvania residents. The AG launched an online reporting portal on September 26, 2024, to streamline the reporting process.

Consumer Reporting Agencies

When a breach affects more than 500 Pennsylvania residents notified at one time, the entity must notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, without unreasonable delay. The notification must include the timing, distribution, and content of the consumer notice. Act 33 of 2024 lowered this threshold from 1,000 to 500.

12-Month Credit Monitoring Requirement

One of the most significant additions in Act 33 is the mandatory credit monitoring provision. When a breach involves any of the following data elements, the entity must offer affected individuals:

• Access to an independent credit report from a consumer reporting agency
• 12 months of credit monitoring services

This requirement is triggered when the breach involves:

• Social Security numbers
• Driver's license numbers or state ID numbers
• Bank account numbers

Pennsylvania is notable for extending the credit monitoring trigger beyond Social Security numbers. Most states that require credit monitoring only mandate it for SSN breaches. Pennsylvania's requirement covers driver's licenses and bank accounts as well, significantly expanding the number of breaches that trigger this obligation.

Methods of Notification

Businesses can provide notification through:

• Written notice sent to the individual's last known home address
• Email notice if a prior business relationship exists and the entity has a valid e-mail address for the individual
• Electronic notice for a credential breach directing the person to change their password and security question, with no prior-relationship requirement, so long as the entity has sufficient contact information for the person (this separate path applies specifically to username/password breaches)
• Telephone notice given in a conspicuous and reasonable manner

Substitute Notice

Substitute notice is available if the entity demonstrates to the Attorney General that:

• The cost of providing direct notice would exceed $100,000, or
• The affected class exceeds 175,000 persons, or
• The entity does not have sufficient contact information

Pennsylvania's substitute notice thresholds ($100,000 and 175,000 persons) are lower than many states, making substitute notice available in a broader range of circumstances.

Substitute notice must include: email notice (where available), conspicuous posting on the entity's website, and notification to major statewide media.

Enforcement and Penalties

Consumer Protection Law Enforcement

Violations of BPINA constitute unfair or deceptive acts or practices under the Pennsylvania Unfair Trade Practices and Consumer Protection Law (UTPCPL). This classification gives the Attorney General broad enforcement authority, including:

• Injunctive relief to stop ongoing violations
• Civil penalties
• Restitution for affected consumers

Attorney General Authority

The Pennsylvania Attorney General's Bureau of Consumer Protection is the primary enforcement agency. The AG can investigate complaints, issue subpoenas, and bring civil actions.

No Private Right of Action

The UTPCPL generally provides a private right of action for unfair or deceptive practices, but BPINA's own enforcement section gives the Pennsylvania Office of Attorney General exclusive authority to bring an action under the UTPCPL for a BPINA violation. There is no private right of action under BPINA itself, so an individual cannot sue a business directly under this act for a notification failure. Separate common-law theories, such as a negligence claim, are a different legal question outside BPINA's enforcement scheme.

Exemptions

HIPAA Compliance Exemption

Covered entities and business associates subject to and in compliance with HIPAA's breach notification requirements are deemed to be in compliance with BPINA.

Financial Institution Exemption

Financial institutions subject to and in compliance with the Gramm-Leach-Bliley Act's interagency guidance on breach notification are exempt from BPINA's separate notification requirements.

Own Policy Exemption

Entities that maintain their own notification procedures as part of an information privacy or security policy are deemed to be in compliance, provided those procedures are at least as thorough as BPINA's requirements and the entity follows its own procedures.

What Changed Under Act 33 of 2024 (Summary)

For businesses already familiar with Pennsylvania's earlier breach notification law, here are the key changes effective September 26, 2024:

This article provides general legal information about Pennsylvania data privacy laws and breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Pennsylvania for guidance specific to your situation.

More Pennsylvania Laws

• Pennsylvania Deepfake Laws
• Pennsylvania Employee Monitoring Laws
• Pennsylvania GPS Tracking Laws
• Pennsylvania Recording Laws