Florida's Data Breach Notification Law Got Teeth in 2019 — Is Your Business Ready?

Florida's Information Protection Act — commonly called FIPA — has been on the books since 2014, but enforcement activity and public awareness around the law have grown significantly in 2019 as data breaches have become more frequent, more visible, and more consequential for affected consumers. If you own or manage a business in Florida that collects, maintains, or processes personal information about Florida residents, FIPA creates specific, time-sensitive obligations that apply to you — regardless of your business size.

What FIPA Covers: The Definition of Personal Information

Under FIPA, "personal information" means an individual's first name or first initial and last name in combination with any of the following data elements when the name or data is not encrypted:

• Social Security number
• Driver's license or Florida identification card number
• Financial account number (credit or debit card number) combined with security code, access code, or password
• Medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional
• Health insurance policy number or subscriber identification number
• Username or email address combined with a password or security question and answer

If your business collects any combination of the above — and most businesses do, even just through a contact form that captures name and email — you are within FIPA's scope.

What FIPA Requires When a Breach Occurs

The 30-Day Notification Clock

FIPA requires that you notify affected Florida residents within 30 calendar days of discovering a breach of security. "Breach of security" means unauthorized access of data in electronic form containing personal information. The 30-day clock starts from discovery — not from when the breach occurred. If you discovered a breach today that started six months ago, your 30-day notification obligation started today.

Content of the Required Notification

The notification to affected individuals must include: a description of the incident, the approximate date the breach occurred and was discovered, the types of personal information that were involved, steps taken to protect affected individuals from further harm, a contact number or email for the business, and information about what actions affected individuals can take to protect themselves.

Department of Legal Affairs Notification

If the breach affects more than 500 Florida residents, you must also notify the Florida Department of Legal Affairs. Notification must occur in the same timeframe as individual notification — within 30 days of discovery.

What You Need to Have Ready Before a Breach Happens

1. 1A written incident response plan that includes your breach notification process and responsible parties — "figure it out when it happens" is not a plan
2. 2Pre-identified legal counsel experienced in data breach response — finding an attorney for the first time after a breach happens in the middle of a chaotic 30-day window
3. 3A list of all systems and databases containing personal information, so you can quickly assess scope when an incident is discovered
4. 4A draft notification template that can be customized quickly — notification language has legal implications and should be reviewed by counsel in advance, not drafted under pressure
5. 5Cyber liability insurance that covers breach notification costs — individual notification at scale (certified mail, call centers) can cost $5–$20 per affected individual