Pennsylvania Data Breach Notice Rules Every Business Should Know
If your business stores personal information on Pennsylvania residents and that information is exposed, you are not just dealing with an IT problem. You have legal obligations under Pennsylvania's Breach of Personal Information Notification Act, and the law changed in meaningful ways when it was amended in 2024. This article walks through what the statute requires. It does not cover North Carolina's separate notification law, which we've addressed in a companion article on NC breach duties, and the two states differ on several points worth knowing if you operate in both.
What counts as a breach under Pennsylvania law
Pennsylvania's statute is triggered by unauthorized access to or acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. "Personal information" generally means a person's name combined with a data element like a Social Security number, driver's license number, or financial account number along with any required security code or password. Pennsylvania has also extended coverage to certain additional categories, including some forms of medical and health insurance information, so a breach involving health records can trigger notice obligations even without a Social Security number attached. If the exposed data was encrypted and the encryption key was not also compromised, the statute generally treats that as outside the notice trigger, though whether your specific encryption method qualifies for that safe harbor is a fact-specific question.
Notice to affected individuals
Once a business determines a breach has occurred, it must notify affected Pennsylvania residents without unreasonable delay. Pennsylvania does not set a fixed number of calendar days the way some states do. Instead, the standard asks what is reasonable given the need to investigate the scope of the breach, restore the integrity of the system, and determine whose information was actually involved. That flexibility cuts both ways: it gives a business room to investigate before firing off notices, but it also means a business that sits on a known breach for weeks without a good explanation is exposed to scrutiny. Notice can typically be given by mail, by telephone, or by email if the business already communicates with the individual electronically, and the statute allows substitute notice (website posting and media notice) when direct notice would be too costly or when the business does not have sufficient contact information.
What changed in the 2024 amendment
The 2024 amendment added two requirements that businesses handling Pennsylvania residents' data need to build into their incident response planning.
- Notice to the Pennsylvania Attorney General. When a breach affects a sufficiently large number of Pennsylvania residents, the business must also notify the Office of Attorney General, not just the individuals affected. The exact threshold and the required content of that notice are details worth confirming against the current statutory text or with counsel before you rely on them, since the specifics matter and we do not want to state a number here that could be out of date by the time you read this.
- Credit monitoring in certain breaches. For breaches involving specific categories of sensitive data, most notably Social Security numbers, the amendment requires the business to offer affected individuals credit monitoring services for a defined period at no cost. Again, which categories of data trigger this obligation and exactly how long the monitoring must last are details that depend on the current statutory language, and they are worth verifying before you commit to a specific offer in a notice letter.
Both of these additions move Pennsylvania closer to the breach notification regimes many other states already had, and they reflect an increased willingness by the state to treat personal data exposure as something that warrants a government-facing response, not just a private one between the business and its customers.
Why the details matter more than the general rule
A business that treats "notify people and move on" as the whole obligation is likely missing steps that now carry their own consequences. Whether the Attorney General notice requirement applies to a given incident depends on how many Pennsylvania residents were affected, which means a business needs a reliable count of affected individuals before it can even answer that threshold question. Whether credit monitoring is required depends on exactly what categories of data were exposed, not just whether a breach occurred at all. These are fact-intensive determinations, and getting them wrong, either by under-notifying or by making representations in a notice letter that overstate or understate the business's obligations, creates its own exposure.
Where this fits with your vendor contracts
Most businesses do not experience a breach of their own systems first. More often, the first notice a business gets is that a vendor, a payroll processor, a SaaS platform, or a marketing contractor was breached and some of the business's customer or employee data was involved. Whether that vendor is obligated to tell you promptly, and whether you have the right to control or review the notice language that goes out to your own customers, depends entirely on what your vendor agreement says. A thin contract with no breach notification clause leaves you finding out from a news story instead of from the vendor. We've written separately about what a vendor data breach notification clause should require and about what belongs in a data processing agreement with any vendor that touches your customers' personal information.
What this firm does and does not handle
To be direct about scope: S&A Law handles the contract side of data security work. That means drafting and negotiating vendor agreements, data processing agreements, and the clauses that determine who has to tell whom when something goes wrong. We do not run breach response itself, meaning we are not the team that drafts your individual notice letters, coordinates with forensic investigators, or manages the Attorney General notice once a breach has already happened. If you are mid-breach right now, you need an incident response team and likely breach counsel with that specific focus.
Where we add the most value is before the breach happens, making sure your vendor contracts put the notification burden and the cost of response on the party best positioned to bear it, and making sure your own data processing agreements with clients don't leave you holding obligations you didn't negotiate for. If you want your vendor agreements reviewed with Pennsylvania's current notice obligations in mind, our Privacy & Data Security practice can take a look, and you can reach our Greater Philadelphia office through our contact page to set up a consult.