Law note · Florida
Florida Information Protection Act, breach notification
A covered entity, defined broadly as any commercial entity that acquires, maintains, stores, or uses personal information, with no revenue gate of any kind, must provide notice to the Department of Legal Affairs of a breach affecting 500 or more individuals in Florida as expeditiously as practicable and no later than 30 days after determining a breach occurred or having reason to believe one occurred, and must give notice to each affected Florida individual on the same 30-day deadline, extendable by 15 days on a written good-cause showing.
This statute reaches far more entities than FDBR's $1 billion-plus controller duties and must not be conflated with FDBR. Originally enacted in 2014 (ch. 2014-189/190) and amended repeatedly since, including by the same 2023 bill that created FDBR and again by ch. 2026-52 in the 2026 session, the underlying research did not establish a dated original commencement from the codified text, so no effective_date is recorded here.
The statute expressly bars a private cause of action, so a breach violation does not reach a private plaintiff, through FDUTPA or otherwise.
What it asks of an app
- Notify the Florida Department of Legal Affairs of a breach of security affecting 500 or more individuals in Florida as expeditiously as practicable, and no later than 30 days after determining a breach occurred or having reason to believe one occurred.
- Notify each affected Florida individual of a breach no later than 30 days after determining a breach occurred, unless you obtain a written 15-day extension for good cause.
- Do not conflate this statute's much broader reach with FDBR's controller duties. This breach-notice duty binds any commercial entity that acquires, maintains, stores, or uses personal information, with no $1 billion revenue gate.
- Expect no private right of action for a violation of this section, including through FDUTPA; the statute expressly forecloses one.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Florida statute text, Florida Statutes, Florida Legislature