Arkansas Personal Information Protection Act, reasonable security procedures

Ark. Code Ann. section 4-110-104(b)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force.

A security baseline statutes rule binding public and private bodies.

As of 15 September 2026.

What it requires

This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.

If you get it wrong

Criminal exposureNo

Who enforces it

Enforcement body

The Arkansas Attorney General, acting under the Arkansas Deceptive Trade Practices Act (Ark. Code Ann. secs. 4-88-101 et seq.); the statute names no other regulator and no penalty amount of its own.

Settledness

As of: 15 September 2026
Open questions: Ark. Code Ann. section 4-88-113 (Deceptive Trade Practices Act) creates a private cause of action for a violation of that Act: does that private right of action also reach a violation of the Personal Information Protection Act's separate reasonable-security duty at section 4-110-104(b), which section 4-110-108 places under Attorney General enforcement only?

What it reaches

Obligation class

Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A person or business that acquires, owns, or licenses personal information about an Arkansas resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

This reasonable-security duty sits in the same Act, and the same code section, as the Act's separate duty to take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information that is no longer to be retained, and it is legally distinct from the Act's breach-notification duty at section 4-110-105, already researched as this jurisdiction's privacy row.

"Business" is defined to include a state agency, so the duty reaches Arkansas's own state agencies as well as private persons and businesses. The reasonable-security duty has not been amended since the Act's original 2005 enactment: the only later amendment to this subchapter located, Act 1030 of 2019, added biometric data elements to the definition of personal information and separately amended the breach-notification section, and left this duty's own text untouched.

Act 1526 of 2005 itself states no day-precise commencement date and carries no emergency clause, so its default constitutional commencement, ninety days after the 2005 Regular Session's sine die adjournment, is not pinned to a calendar day from primary text here.

The Act names no dedicated regulator and no penalty amount of its own for a violation of this duty; any violation of the subchapter is punishable only by action of the Attorney General under the Arkansas Deceptive Trade Practices Act, and whether that Act's own private-suit provision also arms a private plaintiff for a violation of the reasonable-security duty specifically was not confirmed from primary text.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics
serves_minors
operates_social_platform
ships_mobile_app
distributes_software_product

Read the law

Official Arkansas General Assembly session-law text, Act 1526 of 2005 (SB1167), sec. 4 (original enactment of Ark. Code Ann. sec. 4-110-104)
confirmed unamended and currently in force against codes.findlaw.com's Arkansas Code Title 4 mirror, current as of March 28, 2024; enforcement clause confirmed against the same mirror's section 4-110-108

Back to the example · Lint your app