Meet Illinois PIPA breach notice and security duties with confidence

The Illinois Personal Information Protection Act (PIPA), codified at 815 ILCS 530, is Illinois's data breach notification and data security law. It requires data collectors to notify affected Illinois residents after a breach of personal information, to notify the Attorney General of larger breaches, to keep reasonable security measures, and to dispose of personal information securely. It is separate from the Biometric Information Privacy Act (BIPA), which governs biometric identifiers.

Illinois PIPA applies to any data collector that handles nonpublic personal information about Illinois residents, wherever the organisation is based. The Act lists government agencies, universities, corporations, financial institutions and retailers as examples. Data collectors that only maintain or store data for others must notify the data owner of a breach, and State agencies have their own notice and reporting duties under Sections 12, 25 and 30.

Personal information means a first name or initial and last name combined with a Social Security number, driver's licence or State ID number, financial account or card number with any required access code, medical information, health insurance information or unique biometric data, where the data is unencrypted or the keys were also taken. It also covers a username or email address with a password or security question and answer that permits access to an online account.

Affected Illinois residents must be notified in the most expedient time possible and without unreasonable delay, consistent with measures needed to determine the scope of the breach and restore system integrity. If more than 500 Illinois residents are notified as a result of a single breach, the Attorney General must also be told, no later than when consumers are notified. Notice may be delayed only if law enforcement requests it in writing.

A violation of Illinois PIPA is an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act, which the Attorney General can enforce. Separately, improper disposal of materials containing personal information under Section 40 carries a civil penalty of up to $100 per affected individual, capped at $50,000 for each instance of improper disposal. Any attempt to waive the Act is void.

Section 45 requires data collectors that own, license, maintain or store personal information about Illinois residents to implement and maintain reasonable security measures against unauthorised access, acquisition, destruction, use, modification or disclosure. Contracts that disclose such information must require the recipient to do the same. The Act does not prescribe specific controls, so recognised frameworks such as ISO 27001 or SOC 2 are a practical way to show reasonable security.

HIPAA covered entities and business associates that comply with HIPAA and HITECH are deemed compliant with Illinois PIPA, provided they notify the Illinois Attorney General within 5 business days of notifying HHS of a breach. Organisations complying with the GLBA safeguards standards are deemed compliant with the Section 45 security duty. ISO 27001 does not grant deemed compliance, but its controls support the reasonable security and incident response the Act expects.

Yes, on request. Illinois PIPA is mapped in OneClickComply's control library and is available on request rather than as a live framework today. Once enabled, it uses the same controls, policies and automated evidence you already hold for frameworks such as ISO 27001 or SOC 2, so breach notification, security and disposal duties are tracked alongside your other work. Our in-house audit team can answer questions through Ask an Auditor.