Florida Data Breach Law: What Small Businesses Need to Know

Florida's data breach law, the Florida Information Protection Act (s. 501.171), applies to almost any business that stores personal information about Florida residents. If a breach exposes that data, you generally must notify affected people within 30 days, and notify the Florida Attorney General within 30 days if 500 or more Floridians are affected.

Written and reviewed by Rich Timmons, Founder and CEO, Titan IT Management. Last reviewed: November 1, 2026.

Almost certainly, if your business keeps personal information about Florida residents in electronic form. The Florida Information Protection Act (FIPA), Florida Statutes section 501.171, applies to sole proprietorships, partnerships, corporations, associations, and other commercial entities that acquire, maintain, store, or use personal information. The statute has no small-business exemption.

What counts as "personal information" in Florida?

Under FIPA, personal information is a person's first name or first initial and last name combined with any of the following:

• A Social Security number
• A driver license or ID card number, passport number, military ID number, or a similar number on a government document used to verify identity
• A financial account, credit card, or debit card number, together with any code or password needed to access the account
• Information about medical history, mental or physical condition, or medical treatment or diagnosis
• A health insurance policy or subscriber ID number
• Biometric data
• Any information about the person's geolocation

A username or email address combined with a password or security question and answer that would allow access to an online account also counts on its own.

That last item matters. A stolen Microsoft 365 or Google Workspace login can itself be personal information under FIPA, before anyone looks inside the mailbox.

Where small businesses keep this data without thinking about it

• Employee onboarding files: W-4s, I-9 copies, and driver license scans
• Patient intake forms and scanned insurance cards at medical and dental offices
• Client tax documents and bank statements sitting in email attachments
• Card numbers typed into notes, spreadsheets, or a CRM
• Old shared folders and retired laptops nobody has cleaned up

A dental office in Stuart or a property manager in Vero Beach probably has several items from that list.

What is not covered

Information a government entity has already made public is excluded. So is information that is encrypted, secured, or modified so it no longer identifies a person or is otherwise unusable. That second exclusion is a strong practical reason to encrypt laptops, phones, and sensitive files.

FIPA defines a breach as unauthorized access of electronic data containing personal information. Notice the word access: the definition does not wait for proof that someone downloaded or used the data. Good-faith access by an employee or agent for business purposes is not a breach, as long as the information is not misused.

Here is what this usually looks like for small businesses on the Treasure Coast:

• A phished Microsoft 365 mailbox full of client attachments. This is a common path, and it often starts as business email compromise.
• Ransomware that copied files before locking them. Knowing how ransomware gets in explains why "we restored from backup" does not end the question.
• A stolen laptop that was not encrypted.
• A vendor, such as a billing service, reporting its own breach involving your customers.
• An email with Social Security numbers sent to the wrong person.

This table summarizes FIPA only. Other laws and contracts may add their own deadlines.

A notice to individuals goes by mail or email. At minimum it must include the date or estimated date range of the breach, a description of the personal information involved, and how the person can contact you with questions.

A notice to the Attorney General's office includes a synopsis of what happened, the number of Floridians affected, any free services offered (such as credit monitoring), a copy of the individual notice, and a contact person. The office can also ask for a police, incident, or forensic report and a copy of your breach policies. That is a good reason to have a written incident response plan and logs before you need them.

What if we are covered by HIPAA or another federal rule?

FIPA treats notice given under the rules of your primary or functional federal regulator as meeting its individual notice requirement. If you also give the Attorney General's office a timely copy of that notice, it meets the Attorney General notice requirement too. For HIPAA covered entities, that generally means the HIPAA Breach Notification Rule, which requires notice to individuals without unreasonable delay and no later than 60 days after discovery. Your attorney can confirm how this applies to you. See our guide to HIPAA cybersecurity requirements and our healthcare IT page.

Other rules that may also apply

Tax preparers and other businesses under the FTC Safeguards Rule must report certain incidents involving 500 or more consumers to the FTC within 30 days of discovery. Law firms have professional duties to clients (see our law firm IT page). Client contracts may add notice terms, and cyber insurance policies usually require prompt notice (see cyber insurance requirements). Your attorney and insurer help sort out which apply.

FIPA requires every covered business to "take reasonable measures to protect and secure data in electronic form containing personal information," and to dispose of customer records securely by shredding, erasing, or otherwise making them unreadable. The statute does not list specific controls. Here is how we translate it for most small offices:

• Know where personal data lives. You cannot protect data you did not know you had.
• Multi-factor authentication on email and remote access. It makes a stolen password far less useful on its own.
• Encrypt laptops and phones. Encrypted data can fall outside FIPA's definition of personal information, and a lost device becomes much less of a crisis.
• Limit access to sensitive folders. Less access means less exposure when one account is compromised.
• Patched systems and monitored endpoint protection. Someone should be watching the alerts, not just installing software.
• Email security and phishing training. Email is where many small business incidents start.
• Tested backups. Backups help you recover, but they do not undo data theft. See does Microsoft 365 include backup and our backup and disaster recovery service.
• Vendor review. Know which vendors hold your data and how fast their contracts require them to tell you about a breach.
• Secure disposal. Wipe or destroy drives in old computers and copiers (see how often to replace computers).
• A written incident response plan. Who calls whom, with phone numbers that still work when email does not.

Does following NIST or another framework protect us from liability in Florida?

Not today. In 2024 the Legislature passed HB 473, which would have limited liability for businesses aligned with recognized cybersecurity frameworks. The Governor vetoed it on June 26, 2024. Frameworks such as the NIST Cybersecurity Framework are still a smart way to organize a security program, but they are not a legal shield in Florida right now.

Putting these safeguards in place and keeping them documented is what managed cybersecurity for Treasure Coast businesses is for.

Your attorney makes the notice decisions. We make sure they have accurate technical facts.

Statute text quoted and summarized from the official Florida Legislature and Florida Senate publications of section 501.171, checked November 1, 2026. Laws change, so confirm current requirements with your attorney.