Law / United States / Illinois
Personal Information Protection Act, data security duty
815 ILCS 530/45 (P.A. 99-503, eff. 2017-01-01)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 January 2017.
A security baseline statutes rule binding public and private bodies.
As of 14 September 2026.
What it requires
- This binds any data collector, including a government agency, a public or private university, or a privately or publicly held corporation, that owns, licenses, maintains, or stores records containing personal information about an Illinois resident.
- Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
- Require, by contract, that any party to whom personal information is disclosed also implement and maintain reasonable security measures over it.
- A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law that requires greater protection, is deemed to comply with this duty.
- There is no dedicated penalty for this section; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to a private action for actual damages and attorneys' fees under 815 ILCS 505/10a and to an Attorney General action for injunctive relief and a civil penalty of up to $50,000, or up to $50,000 per violation where the court finds intent to defraud, under 815 ILCS 505/7.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
815 ILCS 530/45 states no penalty of its own; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act by 815 ILCS 530/20. Under 815 ILCS 505/7(b), the Attorney General or a State's Attorney may seek a civil penalty of up to $50,000; where the court finds the conduct was entered into with intent to defraud, the cap rises to $50,000 per violation rather than a single $50,000 ceiling.
- Rule
- Fixed only
- As of
- 14 September 2026
- Currency
- USD
- Fixed cap
- 50,000
Who enforces it
Enforcement body
815 ILCS 530/45 names no enforcement mechanism of its own. Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, so the Attorney General or a State's Attorney may seek injunctive relief and a civil penalty under 815 ILCS 505/7, and any person who suffers actual damage may bring a private action for damages under 815 ILCS 505/10a.
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data collector, defined to include a government agency, a public or private university, and a privately or publicly held corporation, that owns or licenses, or maintains or stores without owning or licensing, records containing personal information about an Illinois resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
It must require by contract that any party to whom it discloses that information do the same. A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law requiring greater protection, is deemed to comply.
The duty carries no penalty of its own; Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to the Attorney General's injunctive and civil-penalty authority and to a private action for actual damages.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product