Illinois PIPA: a short data breach guide for business owners
The Personal Information Protection Act tells any business holding Illinois residents' personal data how to protect it, dispose of it and report a breach. Here are the basics owners ask about.
Prepared by Prem Tax and Accounting Corp. Last checked against official sources on October 29, 2026.
The Illinois Personal Information Protection Act (PIPA, 815 ILCS 530) is the state's data breach law. The Illinois Attorney General enforces it, as do State's Attorneys through the Consumer Fraud Act. It matters to any business holding residents' names with Social Security, bank or health details. Our Cabinet-Cloud-Cartridge Count maps where that data sits. The official text is on the Illinois General Assembly website.
- Any business holding Illinois residents' personal data is covered; there is no size test.
- Residents get notice as quickly as possible, without unreasonable delay. No day count is set.
- Over 500 Illinois residents in one breach: the Attorney General is told too.
- Reasonable security and unreadable disposal are covered too.
Who it covers
| Group | Covered? | Note |
|---|---|---|
| Data collectors | Yes | Businesses, schools and agencies handling nonpublic personal data. |
| Personal information | Protected | Also an email or user name with a password or security answer that opens an online account. |
| HIPAA and GLBA entities | Sometimes | Treated as meeting parts or all of the Act if they follow those federal laws. |
The numbers
Illinois residents only; statute read October 29, 2026.
| Item | Amount or rule | Year |
|---|---|---|
| Attorney General notice | More than 500 residents, no later than resident notice | Since January 1, 2020 |
| Disposal penalty | Up to $100 per affected person, capped at $50,000 per instance | 2026 |
| Consumer Fraud Act penalty | Up to $50,000, or $50,000 per violation with intent to defraud | 2026 |
Source: 815 ILCS 530
Our checklist
The Cabinet-Cloud-Cartridge Count is our walk through every place client or employee data sits.
- Cabinet: which paper files hold a name plus an SSN, account number or health detail?
- Cloud: which online tools, payroll systems and inboxes hold the same items?
- Cartridge: which backups, drives and old devices hold copies?
- Vendors: does each vendor contract require reasonable security?
- Disposal: how is each location made unreadable when records go?
Mistakes people make
- Waiting for a full forensic report. The law allows time for scope and recovery, not unreasonable delay.
- Naming how many Illinois residents were affected in the notice, or omitting required contact details.
- Tossing records in ordinary trash, or discarding employment tax records before the IRS minimum of 4 years.
Call an attorney about a suspected breach, a police request to delay notice, or a vendor contract moving data.
Common questions
How fast is breach notice due in Illinois?
The law sets no day count. Notice goes out as quickly as possible without unreasonable delay, allowing for scope and recovery work. A written law enforcement request can also delay it.
Does Illinois PIPA apply to a small business?
Yes. There is no size or revenue threshold. HIPAA or GLBA status can change parts of the duties.
Can a customer sue under PIPA?
Not directly. A violation is an unlawful practice under the Consumer Fraud Act, which lets a person with actual damage sue within 3 years. Success is a legal question.
Official sources
- Illinois General Assembly: Personal Information Protection Act, 815 ILCS 530
- Illinois General Assembly: Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505, Sections 7 and 10a
- Illinois Attorney General: data breach notice for businesses
- IRS: data theft information for tax professionals
- IRS: employment tax recordkeeping
Keep reading
Let's talk about your taxes, your business, your plans.
Tell us what you need and we will get back to you quickly. There is no pressure: just a friendly conversation and a clear next step.
4260 Westbrook Dr, Suite 107
Aurora, IL 60504
Monday to Friday, 9:00 am to 5:00 pm, by appointment. Saturday and Sunday by appointment when needed.