Louisiana

Any person that conducts business in Louisiana or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information, must, following discovery of a breach in the security of the system containing such data, notify any resident of the state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Any agency or person that maintains computerized data that includes personal information that the agency or person does not own must notify the owner or licensee of the information if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person through a breach of security of the system containing such data, following discovery by the agency or person of a breach of security of the system.

No notice is required if after a reasonable investigation the person or business determines that there is no reasonable likelihood of harm to customers.

The law applies to ‘Personal Information’ which is defined as an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the name or the data element is not encrypted or redacted:

1. Social Security number;
2. Driver's license number; or
3. Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.