White Paper · Data Privacy · Illinois PIPA

The Illinois Personal Information Protection Act: Breach Notice, Security, and Disposal Duties for Businesses

Who the Act reaches, which data triggers a notice duty, when residents and the Attorney General must hear from you, what the statute requires for security and disposal, and the record your business should keep from the first day of an incident.

By Lincoln Square Law · 15-minute read

If your business keeps customer names alongside card numbers, health insurance details, login credentials or driver’s license numbers for Illinois residents, the Personal Information Protection Act (815 ILCS 530) already applies to you. There is no registration and no size threshold. The Act is triggered by the data you hold, and it imposes three working duties: notify when a breach occurs, keep reasonable security in place, and dispose of records so they cannot be read.

Who counts as a data collector

The Act defines “data collector” broadly. The definition names government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates or otherwise deals with nonpublic personal information (815 ILCS 530/5). The phrase “may include, but is not limited to” makes the list illustrative. A dental practice, a staffing agency, a landlord with applicant files and an online store with customer accounts all fall inside it.

What matters is where the affected person lives, not where the business sits. The notice and security duties attach to personal information “concerning an Illinois resident” (815 ILCS 530/10(a), 815 ILCS 530/45(a)). A company based outside the state that serves Illinois customers runs the same analysis.

The two kinds of personal information

The first category is a person’s first name or first initial and last name combined with one or more of these elements: Social Security number, driver’s license or State identification card number, an account or credit or debit card number (or an account number together with the code or password that permits access to the financial account), medical information, health insurance information, and unique biometric data that the owner or licensee uses to authenticate an individual, such as a fingerprint or a retina or iris image (815 ILCS 530/5).

Two of those elements are broader than many businesses assume. “Medical information” covers medical history, mental or physical condition, and medical treatment or diagnosis by a healthcare professional, including information provided to a website or mobile application. “Health insurance information” covers a policy or subscriber number, any unique identifier a health insurer uses, and medical information in the insurance application and claims history, including appeals records (815 ILCS 530/5). An online intake form or appointment tool can hold both.

The second category needs no name at all: a user name or email address combined with a password, or a security question and answer, that would permit access to an online account (815 ILCS 530/5). A stolen credential table is personal information on its own.

Two limits narrow the scope. Encrypted or redacted data does not count unless the keys to decrypt or read it were acquired without authorization in the same breach. And information lawfully made available to the general public from federal, State or local government records is excluded (815 ILCS 530/5). The biometric element in this Act is a breach-notice question. Consent and retention duties for biometric identifiers come from a different statute, covered in our post on BIPA in 2026.

When an incident becomes a breach

A “breach of the security of the system data” is the unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information maintained by the data collector. It excludes good faith acquisition by an employee or agent for a legitimate purpose of the business, provided the information is not used for an unrelated purpose or further disclosed without authorization (815 ILCS 530/5).

The definition requires acquisition, not merely a theoretical exposure, and it is limited to computerized data. A lost paper file does not trigger this Act’s notice duty, although it may raise disposal issues. A misconfigured server with no evidence of access calls for a documented investigation before any conclusion.

Notice to Illinois residents: timing and content

A data collector that owns or licenses the information must notify each affected resident, at no charge, in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the data system (815 ILCS 530/10(a)). The Act sets no day count. That flexibility is not a grace period. The time is measured against what the business actually needed to scope and contain the incident.

Content depends on the data. Where first-category information was compromised, the notice must include the toll-free numbers and addresses of the consumer reporting agencies, the toll-free number, address and website of the Federal Trade Commission, and a statement that the individual can obtain information about fraud alerts and security freezes from those sources. Where credentials were compromised, notice may be electronic and should direct the resident to promptly change the user name, password or security question and answer, or take other steps to protect every online account that uses the same credentials. The resident notice must not state the number of Illinois residents affected (815 ILCS 530/10(a)).

Notice may be written, or electronic if it meets the federal electronic-consent rules the Act incorporates (815 ILCS 530/10(c), 15 U.S.C. 7001). If an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and gives the business a written request for delay, resident notice may wait, but it must go out as soon as it will no longer interfere with the investigation (815 ILCS 530/10(b-5)). Keep the written request. A verbal ask does not meet the text.

The Attorney General notice above 500 residents

When a single breach affects more than 500 Illinois residents, the data collector must also notify the Illinois Attorney General. That notice must describe the nature of the breach, state the number of Illinois residents affected at the time of notification, and describe any steps the business has taken or plans to take. It is due in the most expedient time possible and without unreasonable delay, and in no event later than when the business notifies consumers (815 ILCS 530/10(e)). The Attorney General may publish the name of the data collector, the types of personal information compromised and the date range of the breach.

The threshold is “more than 500,” so exactly 500 does not trigger it. Count only Illinois residents, and count per breach, not per year. Because the figure is the number known “at the time of notification,” plan for a supplemental update if the count changes. The Act does not say whether a law enforcement delay also defers this notice, so that call should be made with counsel and recorded.

Substitute notice

If the business demonstrates that the cost of notice would exceed $250,000, that the affected class to be notified exceeds 500,000 people, or that it lacks sufficient contact information, it may use substitute notice. Substitute notice consists of email where the business has addresses, a conspicuous posting on its website if it maintains one, and notification to major statewide media or, where the breach affects residents in one geographic area, to prominent local media (815 ILCS 530/10(c)). The operative word is “demonstrates.” Keep the cost estimate or the contact-data analysis that justified the route.

Data you maintain but do not own

Payroll processors, hosts, billing services and software vendors carry a different duty. A data collector that maintains personal information it does not own must notify the owner or licensee immediately following discovery of a breach and cooperate with the owner on matters relating to the breach (815 ILCS 530/10(b)). Resident notice remains the owner’s job. The vendor contract should therefore define what “immediately” means in practice, what information the vendor will hand over, and who pays for notices. Those terms are covered in our vendor contract review checklist and the data terms stack paper.

Reasonable security and the mandatory contract clause

Every data collector that owns or licenses, or maintains or stores but does not own or license, records containing personal information about an Illinois resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure (815 ILCS 530/45(a)). Separately, any contract for the disclosure of that information to a third party must include a provision requiring the recipient to implement and maintain reasonable security measures (815 ILCS 530/45(b)). The second rule is a concrete drafting requirement. Check whether your existing contracts contain it.

The Act does not define “reasonable.” A business subject to a State or federal law requiring greater protection is deemed compliant if it complies with that law (815 ILCS 530/45(c)). We recommend, although the Act does not require it, tying the security program to a recognized framework and keeping the risk assessment that explains why each control fits the data you hold. NIST SP 800-61 Rev. 3, published in April 2025, gives an incident response reference point within the Cybersecurity Framework 2.0.

Disposal of paper and electronic records

Section 40 applies to any “person,” including corporations and other entities, and requires disposal of materials containing personal information in a manner that renders it unreadable, unusable and undecipherable (815 ILCS 530/40(b)). For paper, that means redaction, burning, pulverizing or shredding. For electronic media, destruction or erasure. A business may hire a third party to handle disposal, but the contractor must implement and monitor policies that prohibit unauthorized access during collection, transport and disposal (815 ILCS 530/40(c)). The Attorney General may impose a civil penalty of up to $100 for each individual whose information was improperly disposed of, capped at $50,000 for each instance of improper disposal (815 ILCS 530/40(d)). Unlike the notice duty, this one covers paper.

HIPAA covered entities and financial institutions

A covered entity or business associate that is subject to and in compliance with the HIPAA and HITECH privacy and security standards is deemed to comply with the Illinois Act, on one condition: if it must notify the Secretary of Health and Human Services of a breach, it must also notify the Illinois Attorney General within 5 business days of notifying the Secretary (815 ILCS 530/50). Such an entity is also carved out of the more-than-500 Attorney General notice (815 ILCS 530/10(e)). The benefit turns on actual HIPAA compliance. A practice that cannot show it falls back under every rule described here. The federal calendar is set out in the HIPAA breach notification clock.

Financial institutions get narrower treatment. A business subject to and in compliance with the standards under section 501(b) of the Gramm-Leach-Bliley Act is deemed to comply with the security duty (815 ILCS 530/45(d), 15 U.S.C. 6801(b)). Financial institutions under that Act, and persons subject to the federal consumer-report disposal rule, are outside section 40 (815 ILCS 530/40(f), 15 U.S.C. 1681w). In the text we reviewed, neither provision relieves them of resident notice under section 10. Non-bank financial institutions under the FTC Safeguards Rule also owe their own notice to the FTC when a notification event involves at least 500 consumers, as soon as possible and no later than 30 days after discovery (16 C.F.R. 314.4(j)).

Enforcement through the Consumer Fraud Act

A violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act (815 ILCS 530/20). That gives the Attorney General the remedies of that statute, including injunctions, restitution, and a civil penalty of up to $50,000, or up to $50,000 per violation where the court finds intent to defraud (815 ILCS 505/7). Separately, a person who suffers actual damage as a result of a violation may sue, and the court may award reasonable attorney’s fees and costs to the prevailing party (815 ILCS 505/10a).

What the statute leaves for the business to decide

The Act does not define when a breach is “discovered,” sets no day count for resident notice, and does not define “reasonable.” The business’s own record fills those gaps. Section 10(d) offers a useful path: a data collector that maintains its own notification procedures as part of an information security policy, and is otherwise consistent with the Act’s timing requirements, is deemed to comply with the notice requirements (815 ILCS 530/10(d)). A written policy that names owners, thresholds and internal deadlines turns an open standard into a procedure the business can show it followed.

Triage in the first days

We recommend a fixed order. First, contain the incident and preserve system logs before restoring or reimaging anything. Second, record the date and time someone in the business first noticed the problem, and who it was. Third, identify which data sets were exposed and whether they held any section 5 element in readable form. Fourth, establish whether there is evidence of acquisition. Fifth, determine how many of those affected are Illinois residents and whether any of the data belongs to a client, which triggers the immediate notice under section 10(b). If a vendor told you about the incident, the date of its notice is your starting point.

The decision record and the evidence to keep

Every incident, notified or not, should leave a dated decision memo. It should record the facts known at each stage, the data elements involved, whether they were encrypted and whether keys were exposed, the conclusion on acquisition, the Illinois resident count and how it was derived, the basis for any delay, and who approved the decision. If you conclude there was no breach, the memo should explain why by reference to the section 5 definition.

Keep with the memo the system logs and forensic report, the vendor’s notices and correspondence, any written law enforcement delay request, a copy of each version of the notice sent with its date and delivery method, the recipient list, the Attorney General submission and its confirmation, the calculation behind any substitute notice, and the notification policy in force on the date of the incident.

Who gets notified, and in what order

• If you hold another business’s data: notify the owner immediately following discovery and cooperate (815 ILCS 530/10(b)).
• If law enforcement asks in writing for delay: file the request and set a date to revisit it (815 ILCS 530/10(b-5)).
• If one breach affects more than 500 Illinois residents: notify the Attorney General no later than you notify residents (815 ILCS 530/10(e)).
• Affected residents: in the most expedient time possible and without unreasonable delay, with the content the data type requires (815 ILCS 530/10(a)).
• HIPAA-compliant entities: notify the Attorney General within 5 business days after notifying the HHS Secretary (815 ILCS 530/50).
• Non-bank financial institutions under the Safeguards Rule: FTC notice no later than 30 days after discovery where at least 500 consumers are involved (16 C.F.R. 314.4(j)).