The Florida Information Protection Act: Section 501.171's Security Duty, Two 30-Day Clocks and an Enforcement Record That Stays Sealed

What Fla. Stat. § 501.171 Covers

The statute was created by CS/CS/SB 1524 of the 2014 session, approved on June 20, 2014 as chapter 2014-189 and effective July 1, 2014. Section 1 of that act gives its short title as the "Florida Information Protection Act of 2014." Section 2 repealed the state's earlier breach provision, section 817.5681, and section 3 created section 501.171, titled "Security of confidential personal information." A companion bill, CS/CS/SB 1526, became chapter 2014-190 and added the public records exemption in subsection (11).

The section's history line lists three later changes. Chapter 2019-32 (HB 7047) removed the scheduled October 2, 2019 repeal of the public records exemption. Chapter 2023-201 (CS/CS/SB 262), the act that also created the Florida Digital Bill of Rights, added two data elements to the definition of personal information; its section 25 took effect July 1, 2024. Chapter 2026-52 (SB 7026), approved April 23, 2026, struck the reference to trade secrets from the definition of proprietary information in subsection (11)(d).

A covered entity is "a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information." For the notice duties in subsections (3) through (6), the term also includes a governmental entity, defined as any state department, board, district, authority or other instrumentality that handles electronic personal information. A third-party agent is an entity contracted to maintain, store or process personal information on behalf of a covered entity or governmental entity.

Florida's breach definition is shorter than most. A breach is "unauthorized access of data in electronic form containing personal information." It has no acquisition element and no harm element; harm enters later, as a ground for skipping individual notice. Good-faith access by an employee or agent is excluded if the information is not used for an unrelated purpose or subject to further unauthorized use.

Personal information has two branches. The first is a first name or first initial and last name combined with any of seven elements:

• A Social Security number
• A driver license or identification card number, passport number, military identification number, or other similar number on a government document used to verify identity
• A financial account, credit or debit card number with any required security code, access code or password
• Any information regarding medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional
• A health insurance policy or subscriber number and any unique identifier a health insurer uses to identify the individual
• Biometric data as defined in section 501.702, added by chapter 2023-201
• Any information regarding an individual's geolocation, also added by chapter 2023-201

The second branch is a user name or email address combined with a password or security question and answer that would permit access to an online account, with no name required. Section 501.702, the definitions section of the Digital Bill of Rights, defines biometric data as data generated by automatic measurements of biological characteristics such as fingerprints, voiceprints, retinas or irises, and excludes photographs, video and audio recordings, and information collected, used or stored for treatment, payment or operations under HIPAA. Personal information excludes information made publicly available by a government entity and information that is "encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable."

The Reasonable Measures Duty in Subsection (2)

Subsection (2) is one sentence: "Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information." The statute does not list what reasonable measures are. It names no framework, sets no program elements, and requires no written plan, which separates it from statutes that spell out administrative, technical and physical safeguards.

Subsection (8) adds a disposal duty for records in any form. Covered entities and third-party agents must take all reasonable measures to dispose of customer records containing personal information when they are no longer to be retained, by "shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means." Customer records are defined by purpose: material provided by an individual in Florida to a covered entity to purchase or lease a product or obtain a service.

Notice to Individuals Within 30 Days

Under subsection (4)(a), notice goes to each individual in Florida whose personal information was, or is reasonably believed to have been, accessed. It is due "as expeditiously as practicable and without unreasonable delay," allowing time to determine scope, identify affected individuals and restore the system, "but no later than 30 days after the determination of a breach or reason to believe a breach occurred."

Two paragraphs displace the 30 days. Under (4)(b), a federal, state or local law enforcement agency that determines notice would interfere with a criminal investigation can delay it by written request for a specified period, and can later revoke or extend that period in writing. Under (4)(c), notice is not required if, "after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies," the covered entity reasonably determines the breach "has not and will not likely result in identity theft or any other financial harm." That determination must be in writing, kept for at least five years, and sent to the Department of Legal Affairs within 30 days.

Direct notice is by mail or email to the address in the entity's records. It must include, at a minimum, the date or estimated date range of the breach, a description of the personal information accessed, and contact information for inquiries. Substitute notice, meaning a conspicuous website posting plus print and broadcast media notice, is available where direct notice would cost more than $250,000, where more than 500,000 people are affected, or where the entity has no mail or email address. Under (4)(g), an entity that notifies under the rules of its primary or functional federal regulator is deemed compliant with subsection (4), and timely sending the Department a copy of that notice satisfies subsection (3).

Notice to the Department of Legal Affairs at 500 Individuals

Subsection (3)(a) requires notice to the Department of Legal Affairs of "any breach of security affecting 500 or more individuals in this state," on the same deadline: as expeditiously as practicable, no later than 30 days after determination. The extension sentence is worded unusually. It sits in subsection (3) but provides that a covered entity "may receive 15 additional days to provide notice as required in subsection (4)" if good cause for delay is given to the Department in writing within the 30 days.

The written notice to the Department must include five items: a synopsis of events; the number of Florida individuals affected or potentially affected; any free services being offered, with instructions; a copy of the individual notice or an explanation of other actions taken under subsection (4); and the name and contact details of a person from whom more can be learned. On request, the entity must also provide a police, incident or computer forensics report, its breach policies, and the steps taken to rectify the breach. Four public bodies (the judicial branch, the Executive Office of the Governor, the Department of Financial Services and the Department of Agriculture and Consumer Services) may instead post the first four items on an agency-managed website.

Subsection (5) adds a third audience. When a covered entity discovers circumstances requiring notice to more than 1,000 individuals at a single time, it must notify the nationwide consumer reporting agencies, as defined in the Fair Credit Reporting Act, of the timing, distribution and content of the notices, without unreasonable delay.

Third-Party Agents and Their Ten-Day Clock

Subsection (6) runs a shorter clock for the vendor. A third-party agent that suffers a breach of a system it maintains must notify the covered entity "as expeditiously as practicable, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred," and must give the covered entity all the information it needs to comply. The covered entity then gives the subsection (3) and (4) notices.

An agent may give those notices on the covered entity's behalf, but the statute assigns the risk: "an agent's failure to provide proper notice shall be deemed a violation of this section against the covered entity." Agents are directly bound by the security duty in subsection (2) and the disposal duty in subsection (8), and the enforcement paragraph reaches actions against "a covered entity or third-party agent."

Subsection (7) adds a reporting duty that runs to the Legislature rather than to residents. By February 1 each year the Department must report to the Senate President and House Speaker on breaches reported by governmental entities and their agents in the prior year, and the report must identify any governmental entity that violated subsections (2) through (6).

Enforcement Under FDUTPA and the Absence of a Private Right

Subsection (9)(a) provides that a violation "shall be treated as an unfair or deceptive trade practice in any action brought by the department under s. 501.207." Section 501.207, in the Florida Deceptive and Unfair Trade Practices Act, lets the enforcing authority seek a declaratory judgment, an injunction, and actual damages on behalf of consumers or governmental entities, and lets the court order restitution, receivers and restrictions on future activities.

Subsection (9)(b) adds civil penalties for a covered entity that violates the Department notice or the individual notice requirement. The amounts are $1,000 per day for the first 30 days after the violation, then $50,000 for each subsequent 30-day period or portion of one for up to 180 days, and, if the violation continues past 180 days, an amount not exceeding $500,000. The statute specifies that these penalties "apply per breach and not per individual affected by the breach." Collected penalties go to the General Revenue Fund.

Subsection (10) is a single sentence: "This section does not establish a private cause of action."

Subsection (11) shapes what the public can see. Information the Department receives through a breach notice, or through its own or a law enforcement investigation, is confidential and exempt from the public records law until the investigation is completed or ceases to be active. Even afterward, five categories stay exempt: information covered by another exemption, personal information, computer forensic reports, information revealing weaknesses in an entity's data security, and proprietary information.

On the enforcement record, this post records zero. The Department's website, myfloridalegal.com, loaded on October 5, 2026, but it has no page collecting breach notices or actions under section 501.171, and its site search returned no results for "501.171" or for "data breach." The one enforcement report linked from its home page, the February 1, 2026 Digital Bill of Rights annual report, covers that separate law and does not mention breaches. No enforcement action under section 501.171 is described here because none could be retrieved from a primary source.

Frequently Asked Questions