Meet Alaska PIPA breach and data protection duties with confidence

The Alaska Personal Information Protection Act is Alaska Statutes Chapter 45.48, a state law that protects residents' personal information. It requires notice to Alaska residents after a breach of their personal information, gives consumers the right to place security freezes on credit reports, restricts the use and disclosure of Social Security numbers, sets rules for disposing of records and limits what card details may be printed on receipts.

Alaska PIPA applies to any person doing business, any state or local governmental agency (except the judicial branch) and any person with more than 10 employees that owns or licenses personal information about an Alaska resident. Location does not matter: an organisation based outside Alaska, including in the UK, is covered if it holds Alaska residents' personal information. Separate articles cover Social Security numbers, record disposal and card receipts.

Under AS 45.48.010, affected Alaska residents must be told in the most expeditious time possible and without unreasonable delay. Delay is allowed only to determine the scope of the breach, restore the integrity of the system, or when law enforcement says notice would interfere with a criminal investigation. If more than 1,000 residents must be notified, the nationwide consumer credit reporting agencies must also be told.

No. Under AS 45.48.010(c), notice to residents is not required if, after an appropriate investigation and written notification to the Alaska Attorney General, the organisation determines there is no reasonable likelihood of harm to the affected consumers. That determination must be documented in writing and the documentation kept for five years, so a clear incident response record is essential.

For breach notification failures, an information collector is liable to the state for a civil penalty of up to $500 for each Alaska resident not notified, capped at $50,000 in total. For businesses the violation is also an unfair or deceptive act under Alaska consumer protection law. Knowing violations of the Social Security number, record disposal and card truncation rules carry civil penalties of up to $3,000.

Yes. Alaska PIPA covers personal information in any form, not just computerised data, so a breach of paper files can trigger the notification duty. Personal information means an unencrypted or unredacted first name or initial and last name combined with data such as a Social Security number, driver's licence or state ID number, or a financial account or card number with any required access code.

Alaska PIPA does not require ISO 27001 certification or a SOC 2 report, and holding either does not by itself prove compliance. However, the incident response, access control, secure disposal and policy controls in ISO 27001 and SOC 2 support the Act's breach notification and record disposal duties, so evidence collected for those frameworks can be reused to show how Alaska residents' data is protected.

Alaska PIPA is mapped in OneClickComply's control library and available on request. It is not yet a live framework in the product. On request, OneClickComply can link its requirements to controls you already run for other frameworks, so evidence for breach response, record disposal and access to Social Security numbers counts towards Alaska PIPA as well. OneClickComply does not certify compliance.