Illinois Personal Information Protection Act (PIPA) Guide
Learn how Illinois PIPA covers data breach notice, security and disposal duties, with slides, tables and a checklist for small businesses holding client data.
Last reviewed October 29, 2026 · General information, not legal advice
General information only, not legal advice. CPA Tax Payroll and Accounting Corp is a CPA firm, not a law firm. Laws change: confirm with the official source or a licensed attorney before you act. Read the full notice.
The Illinois Personal Information Protection Act, known as PIPA (815 ILCS 530), is the state's data breach law. It asks businesses that hold Illinois residents' personal information to keep reasonable security, dispose of records safely and tell people when a breach happens. The Illinois Attorney General is its main enforcer. This page is for owners, professionals and nonprofits that keep client or employee files. PIPA is a breach and security law, not a full privacy law with consumer rights.
Slide show: PIPA in seven slides
What the law does
It requires reasonable security, safe disposal and breach notice for Illinois residents' personal information.
Who it covers
Any entity that handles nonpublic personal information, of any size, including corporations, retailers, universities and agencies.
The rule
Personal information is a name plus a sensitive item, or an email or username with its password or security answer.
The number
If a breach requires notice to more than 500 Illinois residents, the Attorney General must be told too.
The deadline
Residents must be told without unreasonable delay. No fixed number of days is set.
The penalty
A PIPA violation is an unlawful practice under the Consumer Fraud Act. Improper disposal carries its own penalty.
The tip
A breach response plan is easier to write before a breach than during one.
Who is covered
Question
Answer
Data collector
Any entity that handles, collects or shares nonpublic personal information, including corporations, retailers, financial institutions, universities and agencies
Protected people
Illinois residents
Personal information
First name or initial and last name plus a Social Security number, driver's license or state ID number, account or card number, medical information, health insurance information or biometric data
Online accounts
An email address or username plus a password or security question and answer that would open an online account
Encryption
A readable name or sensitive item still counts. If both are encrypted or redacted, the data falls outside the definition unless the keys were also taken
HIPAA entities
Treated as compliant if they follow HIPAA and the HITECH Act, but one that must notify the federal Department of Health and Human Services (HHS) of a breach must also tell the Attorney General within 5 business days
How it touches your taxes and payroll
Tax and payroll files hold the kind of pairs the law lists: a name next to a Social Security number or bank account number. Employers keep staff Social Security numbers and bank details for payroll and Form W-2 work, so a payroll system breach can trigger notice. Disposal rules also meet IRS record-keeping rules: the IRS says to keep employment tax records at least 4 years after filing the fourth-quarter return, so records are commonly disposed of only after that period, by methods like those the statute lists. See how long to keep tax records and identity theft and the IRS.
