The Letter About Your Information
MCL 445.72 — without unreasonable delay, unless no substantial loss is likely
In Michigan, a person or agency that owns or licenses data and discovers a security breach gives notice to each affected resident without unreasonable delay, unless it determines, acting with the care an ordinarily prudent person would exercise, that the breach has not caused and is not likely to cause substantial loss or injury or identity theft.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldEach affected resident | When, as the section puts itWithout unreasonable delay, or after the scope is determined, or after law enforcement says notice will not impede it |
| Who is toldA person or agency that maintains data it does not own | When, as the section puts itTells the owner |
| Who is toldNotice by telephone | When, as the section puts itCounts only with consent, or if a live conversation happens within 3 business days, otherwise written or electronic notice is also sent |
- Substitute notice is allowed if direct notice would cost more than $250,000.00 or reach more than 500,000 residents of this state.
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed Michigan attorney.
Sources for this section (1)
- MCL 445.72 — Notice of security breach
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Michigan attorney.