This page sets out what the Illinois Personal Information Protection Act requires, with the thresholds and penalty limits. It describes the statute, not any one business. A suspected breach is a time to call an attorney.
What the law requires
| Requirement | In plain words | Section |
|---|---|---|
| Tell residents | Notify each affected Illinois resident at no charge, promptly, allowing for the steps needed to find the scope and secure the system; no fixed day count | 530/10(a) |
| Notice contents | Credit bureau and FTC contact details and a fraud alert and security freeze statement; for login breaches, steps to change credentials. Do not state how many residents were affected | 530/10(a) |
| Stored data | A business that only stores data it does not own tells the owner immediately after discovery | 530/10(b) |
| Law enforcement delay | Notice may be delayed if law enforcement asks in writing because notice would hinder an investigation | 530/10(b-5) |
| Notice method | Written, electronic or substitute notice (email, website and media notice together) | 530/10(c) |
| Attorney General | Notify when one breach requires notice to more than 500 Illinois residents, no later than the resident notice | 530/10(e)(2) |
| Security | Keep reasonable security measures, and require them of recipients by contract | 530/45 |
| Disposal | Make paper and electronic records unreadable and unusable | 530/40 |
Key numbers and dates
| Item | Amount or date | Year in force | Source label |
|---|---|---|---|
| Attorney General notice, private businesses | More than 500 residents in one breach, no later than consumer notice | Since 2020-01-01 | 530/10(e)(2) |
| Substitute notice | Cost over $250,000, more than 500,000 people, or too little contact information | 2026 | 530/10(c)(3) |
| HIPAA entities | Attorney General notice within 5 business days of notifying the federal health department (HHS) | 2026 | 530/50 |
| Disposal penalty | Up to $100 per person, capped at $50,000 per instance | 2026 | 530/40(d) |
| Consumer Fraud Act penalty | Up to $50,000; up to $50,000 per violation if intent to defraud | 2026 | 530/20; 505/7(b) |
| Senior add-on | Up to $10,000 more per violation if the victim is 65 or older | 2026 | 505/7(c) |
State agencies follow different numbers (more than 250 residents, 45 days). For tax professionals the IRS also says to report data theft to a local IRS stakeholder liaison, report to the FTC if 500 or more people are affected, and check each state's attorney general rules. See also identity theft and the IRS and how long to keep tax records.
- The Act takes effect (P.A. 94-36)
- Wider definition and data security duty (P.A. 99-503)
- Attorney General notice added (P.A. 101-343)
Source: Illinois General Assembly
Recent and pending changes
No amendment has been enacted since P.A. 101-343 in 2020, per the statute's source notes and 2025-2026 Public Acts read October 27, 2026.
Penalties and enforcement
The Attorney General runs an online breach notice system. A violation of PIPA is an unlawful practice under the Consumer Fraud Act.
| Tier | What can happen | Section |
|---|---|---|
| Improper disposal | Attorney General penalty after notice and a chance to be heard, or a court action | 530/40(d)-(e) |
| Other violations | At the request of the Attorney General or a State's Attorney, a civil penalty up to $50,000; up to $50,000 per violation with intent to defraud | 505/7(b) |
| Victim 65 or older | Up to $10,000 more per violation | 505/7(c) |
| Private suit | A person with actual damage may sue within 3 years; fees may go to the winner | 505/10a |
Whether a PIPA claim meets the proof rules for a private suit is a legal question. For the federal side, see the GLBA and HIPAA guide.
Official sources
- Illinois General Assembly: Personal Information Protection Act (815 ILCS 530)
- Illinois General Assembly: Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505)
- Illinois Attorney General: Data breach notification for businesses
- IRS: Data theft information for tax professionals
This page is a plain-language summary. The official source controls if there is any difference.