Wisconsin Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Under Wis. Stat. 134.98, Wisconsin businesses must notify affected individuals of a data breach within 45 days of learning that personal information was acquired without authorization. The deadline runs from when the entity becomes aware, not when the breach occurred, and applies to name-plus-identifier combinations including Social Security numbers and biometric data.

Wisconsin's data breach notification law strikes a balance between consumer protection and business flexibility. While the state includes biometric data and DNA profiles in its definition of personal information, setting it apart from states with narrower definitions, it does not require any notification to state agencies and lacks a private right of action for affected consumers.

The statute is codified at Wis. Stat. 134.98. Originally enacted in 2006, the law has been updated periodically, though it remains more concise than the breach notification statutes of many other states.

For a broader look at Wisconsin's privacy framework, see the parent guide to Wisconsin Data Privacy Laws.

Who Must Comply

Wisconsin's breach notification law applies to any entity whose principal place of business is located in Wisconsin, or any entity that maintains or licenses personal information in the state, if that entity knows that personal information in its possession has been acquired by an unauthorized person.

The law also reaches businesses based outside Wisconsin. Under Wis. Stat. 134.98(2)(b), an entity whose principal place of business is not located in Wisconsin must make reasonable efforts to notify each Wisconsin resident whose personal information it knows was acquired by an unauthorized person. Having no Wisconsin office does not place a company outside the statute.

Under Wis. Stat. 134.98(1)(a), "entity" means a person other than an individual that does any of the following: conducts business in this state and maintains personal information in the ordinary course of business; licenses personal information in this state; maintains a depository account, as defined in Wis. Stat. 815.18(2)(e), for a Wisconsin resident; or lends money to a Wisconsin resident. The last two hooks are easy to overlook: an out-of-state bank or lender is covered simply because it holds accounts for or lends to Wisconsin residents. The definition also expressly includes the state and its agencies, authorities, and institutions, including the legislature and the courts, as well as cities, villages, towns, and counties.

Third-party data custodians are covered, but only in a specific situation. Under Wis. Stat. 134.98(2)(bm), a person that stores personal information about a Wisconsin resident, but does not own or license it, must notify the owner or licensee as soon as practicable only if that storer has not entered into a contract with the person that owns or licenses the information. Because most vendors and service providers do operate under a written contract with the data owner, this statutory duty often does not reach them, and their notification obligations are set by that contract instead. Where the statutory duty does apply, the data owner then bears responsibility for consumer notification.

What Qualifies as Personal Information

Under Wis. Stat. 134.98(1)(b), personal information means an individual's last name and first name or first initial, combined with one or more of the following data elements:

• Social Security number
• Driver's license number or state identification card number
• Financial account number, including a credit or debit card account number, or any security code, access code, or password that would permit access to the individual's financial account
• Deoxyribonucleic acid (DNA) profile, as defined in Wis. Stat. 939.74(2d)(a)
• Unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation

Note that the financial element is written disjunctively. A name paired with a standalone security code, access code, or password that would permit access to the account is covered on its own, without the account number.

The inclusion of DNA profiles and biometric data distinguishes Wisconsin from states with narrower definitions. However, unlike states such as Washington or Colorado, Wisconsin does not include medical records, health insurance information, passport numbers, military IDs, or login credentials in its definition.

Personal information does not include information that is lawfully obtained from publicly available records or from federal, state, or local government records lawfully made available to the general public.

What Triggers the Notification Requirement

Notification is required when an entity knows that personal information in its possession has been acquired by a person whom the entity has not authorized to acquire the personal information.

Wisconsin's notification trigger includes a risk-of-harm exception. Under Wis. Stat. 134.98(2)(cm)1., an entity is not required to notify if the acquisition of personal information does not create a material risk of identity theft or fraud to the affected individual. Once the entity knows an unauthorized acquisition has occurred and that it creates a material risk of identity theft or fraud, the notification obligation begins.

Wis. Stat. 134.98(2)(cm)2. supplies a second exemption from the duty to notify: notice is not required where the personal information was acquired in good faith by an employee or agent of the entity, if the personal information is used for a lawful purpose of the entity. Note the structure. This is an exemption from the notice requirement rather than a rule that such an acquisition was never unauthorized, and it turns on the affirmative condition that the information is put to a lawful purpose of the entity.

The 45-Day Notification Deadline

Wisconsin requires entities to provide notice within a reasonable time, not to exceed 45 days after the entity learns of the unauthorized acquisition of personal information.

The 45-day clock begins when the entity learns of the acquisition, not when the breach itself occurred. The statute emphasizes that notification must occur within a "reasonable time," meaning that 45 days is the outer limit, not the target.

A law enforcement agency may request a delay in notification to protect an investigation or homeland security. During such a delay, the entity may not provide notice of or publicize the breach except as authorized by the law enforcement agency. The notification process begins at the end of the delay period.

What the Consumer Notice Must Include

Wisconsin's statute requires that the notice "indicate that the entity knows of the unauthorized acquisition of personal information pertaining to the subject of the personal information."

Beyond this basic requirement, the statute does not prescribe specific content elements. This is less detailed than many states, which require inclusion of credit reporting agency contact information, FTC contact details, and specific remediation steps.

However, the DATCP guidance recommends that notifications include:

• A description of the incident
• The types of personal information involved
• Steps the entity has taken to address the breach
• Contact information for the entity
• Recommendations for consumers to protect themselves
• Contact information for the credit reporting agencies and the FTC

Methods of Notification

Wisconsin allows notification through two primary methods:

• Mail sent to the last known address of the affected individual
• A method the entity has previously used to communicate with the individual

If the entity cannot with reasonable diligence determine the mailing address and has not previously communicated with the individual, it must provide notice by a method reasonably calculated to provide actual notice to the individual.

No Attorney General Notification

Wisconsin does not require notification to the Attorney General, DATCP, or any other state agency when a data breach occurs. This places Wisconsin among a diminishing number of states that do not mandate government notification.

Consumer Reporting Agency Notification

If, as the result of a single incident, an entity is required to notify 1,000 or more individuals, the entity must also notify the nationwide consumer reporting agencies (Equifax, Experian, and TransUnion) without unreasonable delay. The threshold is met at exactly 1,000 notices, not only above it.

The notice to the credit bureaus must include the timing, distribution, and content of the consumer notifications. This requirement aligns with most other states' consumer reporting agency notification provisions.

Encryption Safe Harbor

Wisconsin provides an encryption safe harbor. The notification requirements apply only to personal information that has not been "encrypted, redacted, or altered in a manner that renders the personal information unreadable."

If the compromised data was properly encrypted or rendered unreadable at the time of the unauthorized acquisition, notification is not required.

Federal Regulation Safe Harbors

Wisconsin provides specific safe harbors under Wis. Stat. 134.98(3m):

Financial institutions: An entity subject to and in compliance with the privacy and security requirements of the Gramm-Leach-Bliley Act (15 U.S.C. 6801-6827), or a person with contractual obligations to such an entity, is exempt from Wisconsin's notification requirements if it maintains a policy addressing breaches of information security.

Healthcare entities: An entity described in 45 CFR 164.104(a) that is in compliance with HIPAA security and privacy requirements (45 CFR Part 164) is exempt from the notification requirements.

These safe harbors are broader than those in many states, which often require federally regulated entities to still comply with certain state-specific requirements.

Effect on Civil Claims

Wisconsin includes an important provision in Wis. Stat. 134.98(4): failure to comply with the notification requirements is not negligence or a breach of any duty, but may be used as evidence of negligence or a breach of a legal duty in a civil action.

This means that while there is no standalone private right of action under the breach notification statute, a failure to notify could potentially strengthen a plaintiff's case in a separate negligence or breach-of-duty claim.

Enforcement and Penalties

Wis. Stat. 134.98 does not establish a civil forfeiture or other dollar-amount penalty for noncompliance, and the statute does not name a specific enforcement agency. The only stated consequence for a failure to notify is the evidentiary provision in subsection (4).

There is no private right of action that allows individual consumers to sue directly under this statute, though the evidentiary provision in subsection (4) may support related civil claims.

DATCP maintains guidance documents for businesses on complying with the notification requirements and provides consumer resources for individuals affected by data breaches.

More Wisconsin Laws

• Wisconsin Deepfake Laws
• Wisconsin Employee Monitoring Laws
• Wisconsin GPS Tracking Laws
• Wisconsin Recording Laws