Gov. Jeff Landry signed Senate Bill 386, the Louisiana Data Privacy Act, on May 29, 2026. It became Act 502 and takes effect January 1, 2027, according to the Louisiana Legislature's bill history.
The new law gives consumers rights over their personal data, but it applies mainly to larger companies. It does not change Louisiana's data breach notification law. A business that discovers a breach still has up to 60 days to notify affected residents.
Who the new privacy law covers
Under the enrolled bill, the act applies to a business that operates in Louisiana and meets at least one of these tests:
- Annual gross revenue over $25 million.
- Each year buys, receives, sells or shares for commercial purposes the personal information of 75,000 or more consumers, households or devices.
- Gets 50% or more of its annual revenue from selling consumers' personal information.
The law exempts state agencies and local governments, financial institutions covered by the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofits, colleges and universities, electric utilities and registered pollsters.
In practice, a local business with less than $25 million in revenue that does not sell data or handle a large consumer database is probably outside the act. Confirm that with your attorney.
What covered businesses will have to do
Consumers will be able to confirm and access their data, correct it, delete it, get a portable copy, and opt out of targeted advertising, the sale of their data and certain kinds of profiling. Businesses must respond within 45 days, with one 45-day extension allowed.
Government Technology reported that controllers must "limit the collection of personal data to what is adequate, relevant, and reasonably necessary." Troutman Privacy notes the law also calls for privacy notices, data protection assessments and consent before processing sensitive data.
Only the attorney general can enforce the law. Violations are treated as unfair trade practices under state law, and the act does not allow private lawsuits. From January 1 through July 31, 2027, the attorney general must give a business 30 days' written notice and a chance to fix a problem before opening an investigation.
The breach law every Louisiana business follows
The Database Security Breach Notification Law (R.S. 51:3071 and following) applies regardless of company size. Key points from the statute and the attorney general's rules:
- Personal information means a resident's first name or initial and last name combined with a Social Security number, driver's license number, account or card number with its security code, passport number or biometric data, when that data is not encrypted or redacted.
- Businesses must maintain reasonable security procedures, and when disposing of records with personal information they must take reasonable steps to destroy them, such as shredding or erasing.
- Residents must be notified "in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach." A business that needs more time must give the attorney general written reasons within that 60-day window.
- The attorney general must receive written notice within 10 days after notices go out to residents. Late notice can bring a fine of up to $5,000 per violation, and each day counts as a separate violation.
- A company that holds data it does not own must notify the data's owner of a breach.
- Notice is not required if a reasonable investigation finds no reasonable likelihood of harm, but the written finding must be kept for five years.
What to do now
- List where your business stores Social Security numbers, driver's license numbers, card numbers and other personal information.
- Encrypt that data on laptops, servers and in email. The breach law's definition covers data that is not encrypted or redacted.
- Write a short breach response plan that tracks both the 60-day resident deadline and the 10-day attorney general deadline.
- Review vendor contracts so vendors that hold your data will tell you quickly about a breach.
- If you might meet one of the privacy act's thresholds, map your data and plan how you will handle consumer requests before January 1, 2027.
This article is general information, not legal advice.
WITTCO can help with the technical side, from encrypting devices and securing email to endpoint monitoring and tested backups, so a breach is less likely and easier to handle if one happens.
Sources
- Louisiana State Legislature, "SB386, 2026 Regular Session: Bill History": https://legis.la.gov/Legis/BillInfo.aspx?s=26RS&b=SB386&sbi=y
- Louisiana State Legislature, "Senate Bill No. 386, Enrolled, 2026 Regular Session": https://legis.la.gov/Legis/ViewDocument.aspx?d=1475339
- Troutman Privacy, "Louisiana Enacts Consumer Data Privacy Law" (June 3, 2026): https://www.troutmanprivacy.com/2026/06/louisiana-enacts-consumer-data-privacy-law/
- Government Technology, "Louisiana Legislative Session Yields Cyber, Privacy Laws" (June 23, 2026): https://www.govtech.com/policy/louisiana-legislative-session-yields-cyber-privacy-laws
- Louisiana State Legislature, "R.S. 51:3074": https://legis.la.gov/legis/Law.aspx?d=322030
- Louisiana State Legislature, "R.S. 51:3073": https://legis.la.gov/legis/Law.aspx?d=322029
- Louisiana Office of the Attorney General, "Data Breach": https://www.ag.state.la.us/Page/DataBreach
- Legal Information Institute, "La. Admin. Code tit. 16, § III-701: Reporting Requirements": https://www.law.cornell.edu/regulations/louisiana/La-Admin-Code-tit-16-SS-III-701
