Wyoming Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Wyoming requires businesses to notify affected residents of a data breach in the most expedient time possible and without unreasonable delay under Wyo. Stat. 40-12-502. The law sets no fixed day count; entities must investigate promptly and notify as soon as misuse has occurred or is reasonably likely.

Wyoming's data breach notification law applies exclusively to individuals and commercial entities in the private sector. While the state does not impose a fixed notification deadline or require reporting to state agencies, its definition of personal identifying information is surprisingly broad, encompassing categories that many larger states have yet to adopt, including birth and marriage certificates, tribal identification cards, shared security tokens, and health insurance information.

The law is codified at Wyo. Stat. 40-12-501 (definitions) and Wyo. Stat. 40-12-502 (notification requirements). Originally enacted in 2007, the law was significantly amended in 2015, when the legislature expanded the definition of personal identifying information and added specific notice content requirements.

For a broader look at Wyoming's privacy framework, see the parent guide to Wyoming Data Privacy Laws.

Who Must Comply

Wyoming's breach notification law applies to any individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data containing personal identifying information about Wyoming residents.

The law is specifically limited to the private sector. Government agencies are not covered by this statute. Wyoming state agencies are covered elsewhere instead: Wyo. Stat. 9-21-101(a) requires every executive branch agency to adopt, enforce and maintain a data policy that includes, at subsection (a)(v), processes for identifying and responding to data security incidents, "including breach notification and mitigation procedures." That section expressly excludes the legislature, the judiciary, the University of Wyoming, and the state's community colleges.

Third-party data custodians are also covered. Under Wyo. Stat. 40-12-502(g), a person who maintains computerized data containing personal identifying information on behalf of another business entity must disclose a breach to that entity as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The custodian and the data owner may agree which of them will send the consumer notice, and only a single notice is required for each breach. If they cannot reach an agreement, the party that has the direct business relationship with the Wyoming resident must provide the notice.

What Qualifies as Personal Identifying Information

Wyoming's definition of personal identifying information is among the most comprehensive in the country. Under Wyo. Stat. 40-12-501(a)(vii), personal identifying information means a person's first name or first initial and last name combined with one or more of the data elements specified in Wyo. Stat. 6-3-901(b)(iii) through (xiv), when the data elements are not redacted:

• Social Security number
• Driver's license number
• Financial account number, credit card number, or debit card number combined with any security code, access code, or password permitting access to a financial account
• Tribal identification card
• Federal or state government-issued identification card
• Shared secrets or security tokens known to be used for data-based authentication
• Username or email address combined with a password or security question and answer permitting access to an online account
• Birth or marriage certificate
• Medical information, including medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional
• Health insurance information, including policy numbers, subscriber IDs, unique insurer identifiers, and claims history
• Unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes
• Individual taxpayer identification number

The inclusion of birth and marriage certificates, tribal IDs, shared authentication secrets, and health insurance claims history distinguishes Wyoming from the majority of states. The 2015 amendments added many of these expanded categories.

Personal identifying information does not include information contained in federal, state, or local government records or widely distributed media that are lawfully made available to the general public.

What Triggers the Notification Requirement

A "security breach" under Wyoming law means the unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal identifying information and causes, or is reasonably believed to cause, loss or injury to a Wyoming resident.

The trigger involves a two-part analysis:

1. Material compromise: The unauthorized acquisition must materially compromise the security, confidentiality, or integrity of the data. Minor or inconsequential incidents may not meet this threshold.

2. Loss or injury: The breach must cause, or be reasonably believed to cause, loss or injury to a Wyoming resident.

When an entity becomes aware of a potential breach, it must conduct a good-faith, reasonable, and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. If the investigation determines that misuse has occurred or is reasonably likely, notification is required.

Good-faith acquisition of personal identifying information by an employee or agent of the entity does not constitute a breach, provided the information is not used or disclosed in an unauthorized manner.

Notification Timeline

Wyoming requires notice "in the most expedient time possible and without unreasonable delay," consistent with the legitimate needs of law enforcement and with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the computerized data system.

There is no specific day count. This open-ended standard allows entities flexibility for investigation but provides less certainty than states with fixed deadlines.

Wyo. Stat. 40-12-502(b) allows one delay, and it is narrow: notification "may be delayed if a law enforcement agency determines in writing that the notification may seriously impede a criminal investigation." The determination has to be in writing, and a criminal investigation is the only ground the statute names.

What the Consumer Notice Must Include

The 2015 amendments added specific content requirements for breach notifications. The notice must include, at minimum:

• A toll-free number that the individual may use to contact the entity collecting the data, or its agent, and from which the individual may learn the toll-free contact telephone numbers and addresses for the major credit reporting agencies
• The types of personal identifying information that were or are reasonably believed to have been the subject of the breach
• A general description of the breach incident
• The approximate date of the breach, if reasonably determinable at the time of notice
• In general terms, the actions taken by the entity to protect the system from further breaches
• Advice directing the person to remain vigilant by reviewing account statements and monitoring credit reports
• Whether notification was delayed as a result of a law enforcement investigation, if reasonably determinable

The notice must be clear and conspicuous. These content requirements are more detailed than many states with open-ended notification standards.

Methods of Notification

Wyoming allows notification through one of the following methods:

• Written notice
• Electronic mail notice
• Substitute notice, if the entity demonstrates that the cost of notice would exceed the statutory threshold, the affected class exceeds the statutory threshold, or it does not have sufficient contact information (see Substitute Notice below)

Substitute Notice

Wyoming allows substitute notice, but the thresholds differ depending on whether the entity is based in Wyoming:

Wyoming-based entities may use substitute notice if:

• The cost of notice would exceed $10,000
• The affected class exceeds 10,000 persons
• The entity does not have sufficient contact information

Non-Wyoming-based entities may use substitute notice if:

• The cost of notice would exceed $250,000
• The affected class exceeds 500,000 persons
• The entity does not have sufficient contact information

The lower thresholds for Wyoming-based entities reflect the smaller scale of many in-state businesses.

Under Wyo. Stat. 40-12-502(d)(iv), substitute notice "shall consist of all of the following," not a choice among them:

• Conspicuous posting of the notice on the entity's website, if it maintains a public site
• Notification to major statewide media, and that media notice must itself include a toll-free phone number an individual can call to learn whether or not their personal data was included in the breach

Media notification is therefore cumulative. It is required alongside the web posting, not only as a fallback for an entity that has no website. The general definition of substitute notice at Wyo. Stat. 40-12-501(a)(x) also lists electronic mail notice where the entity has email addresses for the affected persons.

No Attorney General Notification

Wyoming does not require notification to the Attorney General or any other state agency when a data breach occurs. There is also no requirement to notify consumer reporting agencies, regardless of the number of affected residents.

This makes Wyoming one of the least demanding states in terms of government reporting obligations.

No Encryption Safe Harbor

Wyoming does not provide an encryption safe harbor. The words "encrypt" and "encrypted" do not appear anywhere in Wyo. Stat. 40-12-501 or 40-12-502, so encrypting the compromised data does not by itself remove the duty to notify.

The carve-out that does exist is redaction. Under Wyo. Stat. 40-12-501(a)(vii), personal identifying information means a name combined with the listed data elements only "when the data elements are not redacted," and Wyo. Stat. 40-12-501(a)(viii) defines redaction as alteration or truncation of the data such that no more than five digits of the data element remain accessible.

Separately, the duty is triggered only where the unauthorized acquisition materially compromises the data and causes, or is reasonably believed to cause, loss or injury to a Wyoming resident, and where a prompt good-faith investigation shows misuse has occurred or is reasonably likely. Strong encryption can be relevant evidence in that investigation, but it is not a statutory exemption.

Exceptions

Under Wyo. Stat. 40-12-502(c), a financial institution that maintains notification procedures subject to the Gramm-Leach-Bliley Act is deemed in compliance with Wyoming's notification requirements if it notifies affected Wyoming customers under its federal obligations. Similarly, under Wyo. Stat. 40-12-502(h), a covered entity or business associate that complies with HIPAA is deemed in compliance with Wyoming's notification requirements if it notifies affected Wyoming customers under its federal obligations.

Enforcement

The Wyoming Attorney General may bring an action in law or equity to address any violation and for other relief that may be appropriate to ensure compliance, recover damages, or both.

There is no private right of action. Individual consumers cannot sue directly under this statute for notification failures.

The statute does not specify maximum penalty amounts, leaving enforcement remedies to the discretion of the courts. The AG may seek injunctive relief, compliance orders, and damages based on the circumstances of each case.

More Wyoming Laws

• Wyoming Deepfake Laws
• Wyoming Employee Monitoring Laws
• Wyoming GPS Tracking Laws
• Wyoming Recording Laws