Illinois PIPA centers on one idea: a person's name sitting next to a sensitive number or password. The steps below, called the Name-Plus-Number Sweep, are what many owners commonly do to map and protect that data. They are general information and do not show that a business meets the law, and the rules and numbers page has the legal detail.
The Name-Plus-Number Sweep
- List every place a name sits beside a Social Security number, license number, account or card number, medical or health insurance detail, or login with password. Include paper files, laptops, phones, email and cloud storage.
- Note who can open each place, and which outside vendors receive the data, such as payroll, bookkeeping or storage providers.
- Check each vendor contract for a clause requiring reasonable security measures, which the statute asks for.
- Set a disposal routine: shred, burn, pulverize or redact paper, and erase or destroy electronic media. Records are commonly kept until the IRS retention period ends before disposal, as in our record-keeping guide.
- Write a breach response plan: who is called first, who contacts the attorney, and what a resident notice must contain.
- Repeat the sweep each year and after any new vendor or software, and keep the plan's contact list current.
Common mistakes
- Waiting for a full forensic report before notifying. The statute allows time to find the scope and restore the system, not unreasonable delay.
- Leaving required content out of resident notices, or stating how many residents were affected.
- Forgetting the Attorney General notice when more than 500 Illinois residents are affected.
- Not requiring vendors that receive personal information to keep reasonable security by contract.
- Throwing client or employee records into ordinary trash.
- HIPAA entities missing the 5-business-day Attorney General notice.
- Vendors that only store data failing to tell the data owner immediately.
When to talk to an attorney
These are legal questions a CPA cannot answer:
- A suspected or confirmed breach, ransomware event or lost device holding client or employee data.
- Whether notice is required in several states or to regulators besides the Attorney General.
- A law enforcement request to delay notice.
- Vendor and cloud contracts that move personal information.
- A claim or demand from a customer, an employee or the Attorney General.
Frequently asked questions
How soon must a business notify people of a data breach in Illinois?
The statute says "in the most expedient time possible and without unreasonable delay" and sets no number of days. The 45-day figure applies only to State agencies' notice to the Attorney General. HIPAA entities must tell the Attorney General within 5 business days of notifying the federal health department.
When does the Attorney General have to be told?
When one breach requires notice to more than 500 Illinois residents, and no later than the notice to residents. This rule has applied since January 1, 2020.
Does PIPA apply to a small business or a tax preparer?
It has no size threshold. Whether a tax preparer counts as a financial institution under the federal GLBA, which affects the security and disposal duties, is explained in our GLBA and HIPAA guide.
Can a customer sue over a PIPA violation?
PIPA has no private lawsuit of its own. A violation counts under the Consumer Fraud Act, where a person with actual damage may sue within 3 years. Whether a claim meets that Act's requirements is a legal question.
Is encrypted data covered?
Data counts if the name or the sensitive item is readable. If both are encrypted or redacted, they fall outside the definition unless the keys were also taken.
Can a CPA help with these rules?
A CPA can help with the payroll, tax and accounting side, including where tax and payroll files sit, and works alongside the owner's attorney. See our payroll services and the guide to identity theft and the IRS.
Official sources
- Illinois General Assembly: Personal Information Protection Act (815 ILCS 530)
- Illinois Attorney General: Data breach notification for businesses
- IRS: Data theft information for tax professionals
- IRS: Employment tax recordkeeping
This page is a plain-language summary. The official source controls if there is any difference.