ILLINOIS Data Breach Notification Law
815 ILCS 530/ (breach notification); 740 ILCS 14/ (BIPA)
Illinois has two significant consumer data protection laws that together provide some of the strongest protections in the nation. The state's breach notification statute (815 ILCS 530/) requires notification without unreasonable delay. But it is the Biometric Information Privacy Act (BIPA) that has made Illinois the center of the nation's most significant data-related class action litigation — BIPA provides for statutory damages of $1,000 per negligent violation and $5,000 per intentional violation for unauthorized collection or use of biometric identifiers (fingerprints, facial scans, iris scans, etc.), with no need to prove actual harm.
What This Law Covers
ILLINOIS's breach notification law requires businesses and government agencies that maintain personal information about ILLINOIS residents to notify affected individuals when that information is subject to unauthorized access or acquisition. "Personal information" typically includes Social Security numbers, driver's license numbers, financial account numbers, and in many states has been expanded to cover medical data, biometric data, online credentials, and tax IDs.
What the Company Must Tell You
A compliant breach notification to ILLINOIS residents must include:
- ✓A description of the breach — what happened and when
- ✓The types of personal information that were involved
- ✓What the company is doing to investigate and contain the breach
- ✓Steps you can take to protect yourself (e.g., credit freeze, fraud alert)
- ✓Contact information so you can ask questions
Your Right to Sue
ILLINOIS provides a private right of action, meaning consumers can file lawsuits directly under the state's breach notification or privacy law — without waiting for the attorney general to act. BIPA provides $1,000–$5,000 per violation for biometric data; general breach law has limited private action
Attorney General Notification
ILLINOIS's law Must notify AG of breach affecting Illinois residents.
Must notify AG of breach affecting Illinois residents
Legal Disclaimer
This reference is for general educational purposes only and does not constitute legal advice. Last reviewed: 2025-01-01. Laws change frequently — always verify against the current official statute and consult a licensed attorney for advice specific to your situation.
Look up breaches affecting ILLINOIS residents
Search our database for companies that filed breach notifications with the ILLINOIS attorney general.
Legal Disclaimer
The information on this page is provided for general informational purposes only and does not constitute legal advice. Laws change frequently — always verify the current statute with the official state source or consult a licensed attorney in your jurisdiction before taking any action. This site is not a law firm and does not create an attorney-client relationship.