Pennsylvania Amends Its Breach Notification Law

Since June 2006, the Pennsylvania Breach of Personal Information Notification Act¹ has required entities, following the discovery of a data breach, to notify Pennsylvania residents if specific types of their personal information were potentially accessed or acquired by an unauthorized person. Now, over 16 years later, the Act will be amended to put it more in line with the breach notification requirements currently imposed in the majority of other states.

Specifically, on November 3, 2022, Pennsylvania Governor Tom Wolf signed Senate Bill 696, which amends the Act in several important ways. These Amendments go into effect May 2, 2023. This article discusses some of the major Amendments to the Act and suggestions for proactively meeting its requirements.