Florida Data Breach Law (FIPA, § 501.171): A Business Owner's Guide

Florida's data breach law, the Florida Information Protection Act (FIPA), is codified at section 501.171 of the Florida Statutes. It requires businesses that hold Floridians' personal information to take reasonable measures to protect it, to notify affected individuals no later than 30 days after determining a breach, and to notify the Florida Department of Legal Affairs when 500 or more Florida residents are affected. This guide walks through what the statute covers and gives you a practical incident-readiness checklist.

Not legal advice. This article is a plain-language overview for business owners and IT teams. Breach response decisions depend on facts and on other laws (HIPAA, GLBA, other states' statutes, contracts). Consult your attorney before acting on any incident.

Key takeaways

• FIPA applies to commercial entities of any size that acquire, maintain, store or use personal information of Florida residents, and to the third-party vendors that hold it for them.
• "Personal information" includes a name combined with a Social Security, ID, financial account, medical or health insurance number, and also usernames or emails combined with a password.
• The outer deadline for notifying individuals is 30 days after the breach is determined (or there is reason to believe one occurred), and earlier when practicable.
• Breaches affecting 500+ Floridians must also be reported to the Department of Legal Affairs; notifying more than 1,000 people at once also triggers notice to the nationwide consumer reporting agencies.
• The law also requires secure disposal of customer records when they are no longer kept.

Who must comply with section 501.171

The statute uses three key roles:

• Covered entity: a sole proprietorship, partnership, corporation, trust, estate, cooperative, association or other commercial entity that acquires, maintains, stores or uses personal information. A five-person CPA firm in Coral Gables and a logistics company in Doral both qualify. There is no small-business exemption.
• Governmental entity: state and local agencies have parallel duties under the same section.
• Third-party agent: an entity contracted to maintain, store or process personal information on behalf of a covered entity or governmental entity: your managed IT provider, cloud document management vendor, payroll processor or offsite records company.

A breach of security is the unauthorized access of data in electronic form containing personal information. Good-faith access by an employee or agent is not a breach, as long as the information is not used for an unrelated purpose or further disclosed without authorization.

What counts as personal information

Under § 501.171(1), personal information is either:

1. An individual's first name or first initial and last name, in combination with any of:
   • a Social Security number;
   • a driver license or ID card number, passport number, military ID number or other similar number issued on a government document used to verify identity;
   • a financial account number or credit or debit card number, in combination with any required security code, access code or password that is necessary to permit access to the account;
   • information about the individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;
   • a health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual; or
2. A user name or email address, in combination with a password or security question and answer that would permit access to an online account.

Two exclusions matter in practice: information made publicly available by a federal, state or local governmental entity, and information that is encrypted, secured or modified so that it no longer identifies the person or is otherwise unusable. That is the strongest technical argument for full-disk encryption on laptops and encryption at rest for file servers and backups. Practical caution: if the attacker also obtained the key or the credentials that unlock the data, treat it as exposed and talk to counsel.

Note the second category: a stolen list of client portal logins with passwords is reportable on its own, even without Social Security numbers.

The "reasonable measures" duty

Section 501.171(2) requires covered entities, governmental entities and third-party agents to "take reasonable measures to protect and secure data in electronic form containing personal information." The statute does not list specific controls, which means "reasonable" is judged against recognized practice and the sensitivity of the data. For a small or mid-sized firm that typically means:

• multi-factor authentication on email, remote access and every cloud admin account;
• encryption of laptops, servers and backups;
• timely patching and endpoint protection with central monitoring;
• least-privilege access and prompt removal of departing staff;
• logging that lets you answer "what was accessed?" after an incident;
• tested, offline or immutable backups (see our ransomware prevention guide);
• written policies, staff training and vendor contracts that require security and prompt breach notice.

Frameworks such as the NIST Cybersecurity Framework 2.0 and the CIS Critical Security Controls are good yardsticks. Our cybersecurity services are built around them.

Notification deadlines and who must be told

Who must be notified	When it applies	Deadline under § 501.171
Affected individuals (Florida residents)	Personal information was, or is reasonably believed to have been, accessed in a breach	As expeditiously as practicable and without unreasonable delay; no later than 30 days after the determination of a breach or reason to believe one occurred
Florida Department of Legal Affairs	Breach affects 500 or more individuals in Florida	As expeditiously as practicable; no later than 30 days after the determination
Nationwide consumer reporting agencies	More than 1,000 individuals notified at a single time	Without unreasonable delay
The covered entity (notice from its vendor)	A third-party agent suffers a breach of data it holds for you	As expeditiously as practicable; no later than 10 days after the agent's determination

Notice to individuals

Notice goes by written letter to the mailing address in your records or by email. It must include the date, estimated date or date range of the breach; a description of the personal information accessed; and contact information so the person can ask questions. Substitute notice (a conspicuous website posting plus media notice) is allowed only in narrow situations defined in the statute, such as when there is insufficient contact information or the scale of notice crosses the statutory thresholds.

Two adjustments are available:

• Law-enforcement delay. If a law-enforcement agency determines that notice would interfere with a criminal investigation, notice is delayed upon the agency's written request for a specified period, which can be extended.
• No-harm determination. Notice is not required if, after an appropriate investigation and consultation with relevant law enforcement, you reasonably determine that the breach has not and will not likely result in identity theft or any other financial harm. That determination must be documented in writing, kept for at least five years and provided to the Department of Legal Affairs within 30 days.

If you notify under the rules of your primary or functional federal regulator (for example, a HIPAA covered entity following the HHS breach notification rule), that notice is deemed to satisfy the individual-notice requirement, but you must still send a copy to the Department of Legal Affairs.

Notice to the Department of Legal Affairs

For 500+ affected Floridians, the written notice must include a synopsis of events, the number of Floridians affected or potentially affected, any services offered free of charge (such as credit monitoring), a copy of the individual notice or an explanation of why it was not sent, and a contact person. On request, the business must also provide police reports, forensic reports, its breach policies and the steps taken to rectify the breach. A covered entity can receive 15 additional days to give individual notice if it provides good cause in writing to the Department within 30 days after determining the breach.

Third-party agents

Vendors that store or process your data must tell you within 10 days of determining a breach and give you what you need to comply. The vendor may send notices on your behalf, but under the statute the responsibility remains yours. Review your contracts: they should require notice faster than the statutory maximum, cooperation with forensics, and cyber insurance.

Disposal of customer records

Section 501.171(8) requires reasonable measures to dispose of customer records containing personal information when they are no longer to be retained, by shredding, erasing or otherwise modifying the information to make it unreadable or undecipherable. Practical implications:

• a written retention schedule (by record type) so disposal actually happens;
• certified data destruction for retired drives, copiers and NAS units;
• deletion workflows for cloud mailboxes and shared drives of departed clients;
• certificates of destruction kept on file.

Enforcement

A violation is treated as an unfair or deceptive trade practice in actions brought by the Department of Legal Affairs. Failing to provide the required notices exposes the entity to civil penalties that accrue per day and escalate over time, up to a statutory cap per breach. The statute does not create a private cause of action, although other legal theories may still be raised in litigation, which is one more reason to involve counsel early.

Incident-readiness checklist

Use this before you need it, not during the incident:

1. Data map. Know which systems hold personal information as defined above, and for which residents.
2. Encryption inventory. Confirm laptops, servers, backups and removable media are encrypted, and that keys are stored separately.
3. Incident response plan. Name the decision-makers, your outside counsel, your IT provider and your cyber insurer's hotline. Align it with NIST SP 800-61 Rev. 3.
4. Logging. Retain sign-in, mailbox and file-access logs long enough to scope an incident.
5. Notice templates. Pre-draft individual and Department notices (EN and ES for bilingual clientele) with counsel.
6. Contact data. Keep current mailing and email addresses for clients and employees; you cannot notify people you cannot reach.
7. Vendor contracts. Require prompt breach notice, security controls and cooperation.
8. Clock discipline. Record the date and time you determined a breach or had reason to believe one occurred; every deadline runs from it.
9. Tabletop exercise. Walk through a scenario (a phished mailbox with tax returns attached, a stolen laptop, ransomware during hurricane-season disruption) at least once a year.
10. Disposal. Follow the retention schedule and document destruction.

FAQ

Does FIPA apply to my small business?

Yes, if you are a commercial entity that acquires, maintains, stores or uses personal information of Florida residents. The statute has no employee-count or revenue threshold, although the duty to notify the Department depends on the number of affected Floridians.

Is a lost encrypted laptop a reportable breach?

Information that is encrypted, secured or modified so it is unusable is excluded from the definition of personal information. If the device was fully encrypted and the key or password was not compromised, it is generally not reportable under FIPA, but document the facts and confirm with counsel.

What if a vendor holding our data is breached?

The vendor must notify you no later than 10 days after determining the breach. The legal duty to notify individuals and the Department stays with your business, so your incident plan should include vendor scenarios.

Does HIPAA notice satisfy Florida's law?

Notice provided under your primary federal regulator's rules is deemed compliant with the individual-notice requirement, but a copy must still go to the Department of Legal Affairs. Ask your attorney how both regimes apply to your facts.

Get ready with Core Florida IT

Core Florida IT helps businesses in Miami, Fort Lauderdale and across South Florida put the technical side of "reasonable measures" in place: encryption, MFA, logging, backups, vendor reviews and incident runbooks that work with your attorney and insurer. Firms with sensitive data, such as law firms and CPA firms, are a core focus. Request a free IT assessment and we will map where your personal information lives and what to fix first.

Sources

• Florida Statutes § 501.171 — Security of confidential personal information (Florida Senate)
• Florida Statutes § 501.171 (Online Sunshine, Florida Legislature)
• Florida Office of the Attorney General
• FTC — Data Breach Response: A Guide for Business
• NIST SP 800-61 Rev. 3 — Incident Response Recommendations
• NIST Cybersecurity Framework 2.0