The Letter About Your Information
Breach of Personal Information Notification Act 3 — without unreasonable delay, and the Attorney General above 500
In Pennsylvania, an entity that maintains, stores or manages computerized data with personal information gives notice of a breach, once it determines one occurred, to any resident of the Commonwealth whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person. Apart from a law enforcement delay and the measures needed to determine the scope of the breach and restore the system, the notice is made without unreasonable delay.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldEach affected resident | When, as the section puts itWithout unreasonable delay |
| Who is toldThe Office of Attorney General, when more than 500 individuals in the Commonwealth must be notified | When, as the section puts itAt the same time, with the date, a summary, and the number affected |
| Who is toldResidents affected by a breach at a State agency | When, as the section puts itWithin seven business days, and the Office of Attorney General at the same time |
| Who is toldResidents affected by a breach at a county, public school or municipality | When, as the section puts itWithin seven business days, and the district attorney within three business days |
| Who is toldA vendor that holds the data for another entity | When, as the section puts itTells that entity after discovering the breach |
- Encrypted information still requires notice if it was taken in unencrypted form, or the breach involved the encryption or someone with access to the key.
- Where the breach exposed a user name or email with a password or security answer, notice may be electronic and direct the person to change the password and protect other accounts that use it.
What counts as personal information, the forms notice may take, and the remedies for a violation are in other sections of the Act and are not reproduced here. Whether a notice was required or on time is a question for the Attorney General, a court, and a licensed Pennsylvania attorney.
Sources for this section (1)
- Breach of Personal Information Notification Act 3 — Notification of breach
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Pennsylvania attorney.