800.668.7020
M-F 8:00AM TO 5:30PM CST
Better coverage. Better price.

Data Breach Laws in Michigan: Notification Requirements and Fines

In the state of Michigan, businesses are required to investigate when a data breach compromises personal information. Businesses must notify affected Michigan residents as soon as possible by mail, telephone, or electronic means. When the security breach reaches more than 500,000 people, or the cost of notification exceeds $250,000, public service announcements can be used in lieu of individual notification. When breaches affect more than 1,000 people, consumer-reporting agencies must be notified, too. Failure to do so can result in fines up to $750,000.

Name of Law / Statute

Identity Theft Protection Act

Definition of Protected Information

Combination of (1) name or other identifying info, PLUS (2) one or more of these "data" elements: SSN; driver's license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes.

Who Is Subject to Law?

Any business that owns or licenses PI of Michigan residents

Notification of Consumers?

Yes, unless determination of no harm by business

By what means?

Written, phone, or electronic (depending on prior relationship); specific regulations re what can and cannot be included in notice

Substitute Notice Threshold?

If cost of notice >$250,000 or involves >500k residents

Notification of authorities / regulators required?

No

By what means?

N/A

Regulatory Fines

Up to $250/non-notice, cap at $750k/breach

Credit monitoring requirement?

No

Private lawsuits allowed?

No

Private damages cap?

N/A

Regulatory actions allowed?

Yes

HIPAA Compliance exemption?

Yes

Other  (e.g., timeframe)

Law does not apply if PI was encrypted

Link to complete law

Michigan's Data Breach Laws

Read the full text of Michigan’s data breach law.

70% of businesses raise prices or cut hiring when sued