M-F 8:00AM TO 5:30PM CST
Better coverage. Better price.

Maine Data Breach Laws: Reporting Requirements and Penalties

In Maine, any business that experiences a data breach must investigate the likelihood that personal information will be abused. Affected Maine residents must be informed as soon as possible through mail or electronic means. If the breach affects more than 1,000 people, or the cost of notification exceeds $5,000, businesses can use public service announcements to meet their notification obligations. If an event affects more than 1,000 people, all consumer-reporting agencies must be notified. Businesses that don’t comply with these regulations can be fined up to $2,500 a day. For details on ME’s data breach laws, keep reading.

Name of Law / Statute

Notice of Risk to Personal Data Act

Definition of Protected Information

Combination of (1) name or other identifying info, PLUS (2) one or more of these "data" elements: SSN; driver's license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes.

Who Is Subject to Law?

Private sector businesses and "information brokers," defined as "any person or entity who … engages in the business of collecting, assembling, evaluating, compiling, reporting, transmitting," PI for non-affiliated third parties

Notification of Consumers?


By what means?

Written or electronic

Substitute Notice Threshold?

If cost of notice >$5000 or for >1000k residents

Notification of authorities / regulators required?


By what means?


Regulatory Fines

Up to $500/violation, $2500/day

Credit monitoring requirement?


Private lawsuits allowed?


Private damages cap?


Regulatory actions allowed?

Yes, for equitable relief or injunction

HIPAA Compliance exemption?


Other  (e.g., timeframe)

Law does not apply if PI was encrypted or redacted

Link to complete law

Maine's Data Breach Law

Read the full text of Maine's data breach law to learn more.

70% of businesses raise prices or cut hiring when sued