Law / United States / Illinois
Personal Information Protection Act, safe disposal of personal information
815 ILCS 530/40 (P.A. 97-483, eff. 2012-01-01)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 January 2012.
A security baseline statutes rule binding public and private bodies.
As of 14 September 2026.
What it requires
- This binds any person, including a natural person, a corporation, another legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident, except a financial institution regulated under Gramm-Leach-Bliley Act Title V or a person subject to the disposal rule at 15 U.S.C. 1681w.
- Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.
- Where a third party is contracted to dispose of the materials, require it to implement and monitor policies and procedures that prohibit unauthorized access to, acquisition of, or use of personal information during collection, transportation, and disposal.
- A violation carries a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard; Section 20 separately deems a violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening the Attorney General's and a private plaintiff's remedies under 815 ILCS 505/7 and 505/10a as well.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
815 ILCS 530/40(d): a civil penalty of not more than $100 for each individual with respect to whom personal information is disposed of in violation of this Section, not to exceed $50,000 for each instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard. Section 20 separately deems any violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening that Act's own civil penalty of up to $50,000 under 815 ILCS 505/7(b) as an additional route.
- Rule
- Per violation only
- As of
- 14 September 2026
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Person
- Per violation amount
- 100
Who enforces it
Enforcement body
815 ILCS 530/40(d) gives the Attorney General authority to impose a civil penalty directly, after notice and an opportunity to be heard, and subsection (e) lets the Attorney General bring a circuit court action for any appropriate relief. Section 20 separately deems a violation of this Act, including this Section, an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening that Act's own Attorney General and private-action remedies as well.
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Any person, defined to include a natural person, a corporation or other legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident must do so in a manner that renders the personal information unreadable, unusable, and undecipherable, such as by redacting, burning, pulverizing, or shredding paper records, or destroying or erasing electronic media.
A third party contracted to dispose of such materials must implement and monitor policies and procedures against unauthorized access, acquisition, or use of personal information during collection, transport, and disposal. A financial institution regulated under Gramm-Leach-Bliley Act Title V, or a person subject to the disposal rule at 15 U.S.C. section 1681w, is exempt.
The Attorney General may impose a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, after notice and an opportunity to be heard, and may separately bring a circuit court action for any appropriate relief; Section 20 also deems a violation of this Section an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product