Pennsylvania Privacy Law Overview
Pennsylvania has not enacted a comprehensive consumer privacy law. Privacy protections for Pennsylvania residents come primarily from the state's data-breach notification statute, its consumer-protection law, and the federal privacy framework. Businesses operating in Pennsylvania should focus on breach preparedness and on the federal sector rules — health, financial, education — that apply to them, while watching the comprehensive-privacy legislation spreading to neighboring states.
Sector-Specific Privacy Laws in Pennsylvania
Pennsylvania Consumer Protection Act
Pennsylvania's consumer-protection statute prohibits unfair and deceptive trade practices, which the Attorney General can use against businesses that misrepresent how they collect, use, or secure personal information.
Breach of Personal Information Notification Act
Pennsylvania's breach-notification law, strengthened by 2022 amendments, requires notice to affected residents and, for larger breaches, to the Attorney General, and sets specific rules for breaches involving state agencies and electronic records.
Data Breach Notification in Pennsylvania
Pennsylvania's data-breach notification law requires businesses to notify affected residents when unencrypted personal information is acquired by an unauthorized person.
- Deadline to notify residents: Without unreasonable delay following discovery
- Attorney General notice: Notify the Pennsylvania Attorney General if 500 or more residents are affected
- Covered data: Name combined with sensitive identifiers (SSN, driver's license, financial-account or medical information, and more)
Pending Privacy Legislation
A comprehensive consumer-privacy bill (HB 78) passed the Pennsylvania House and is under consideration in the Senate, making Pennsylvania one of the more likely states to enact a comprehensive law in the near term.
Federal Privacy Laws That Apply in Pennsylvania
Even where Pennsylvania law is silent, residents and businesses are covered by federal privacy statutes:
- HIPAA — health information held by providers, plans and their vendors
- GLBA — privacy and safeguards rules for financial institutions
- FERPA — student education records
- FCRA — consumer reporting agencies and background screening
- COPPA — online collection of data from children under 13
- FTC Act §5 — unfair or deceptive privacy and data-security practices
Industry-Specific Privacy Requirements in Pennsylvania
Many Pennsylvania businesses face privacy obligations that flow from their industry rather than from a single state statute:
Healthcare
Providers, health plans and their vendors must comply with HIPAA and with any state medical-confidentiality rules when handling patient information in Pennsylvania.
Financial Services
Banks, credit unions, lenders and insurers are subject to the Gramm-Leach-Bliley Act privacy and safeguards rules in addition to Pennsylvania consumer-protection requirements.
Technology & Online Services
Companies serving users in other states may owe duties under California's CCPA/CPRA and other comprehensive laws even while Pennsylvania itself has none — making multi-state compliance the practical reality for most online businesses.
Retail
Retailers handling payment-card data must meet PCI DSS contractual standards and Pennsylvania's breach-notification law if customer information is exposed.
Where to File a Privacy Complaint in Pennsylvania
Pennsylvania residents who believe a business has mishandled their personal information can file a complaint with the Pennsylvania Attorney General, which enforces the state's consumer-protection and data-breach laws. Complaints involving federally regulated data — health, financial, credit or children's information — can also be directed to the Federal Trade Commission or the relevant federal regulator. An attorney can help you assess whether you have a claim and choose the best venue to pursue it.
Pennsylvania Privacy Law FAQ
Does Pennsylvania have a comprehensive consumer privacy law?
Is Pennsylvania likely to pass a comprehensive privacy law?
How a Pennsylvania Privacy Attorney Can Help
For Businesses
- Build and audit a privacy compliance program
- Draft privacy policies, notices and vendor contracts
- Respond to consumer rights requests
- Manage data-breach response and notification
- Defend regulatory investigations and enforcement
For Consumers
- Enforce your privacy rights against non-compliant businesses
- Pursue or join data-breach litigation
- File complaints with the Pennsylvania Attorney General
- Seek damages for identity theft and fraud
- Stop unlawful data sales and unwanted marketing
Need a Pennsylvania Privacy Attorney?
Whether you are a business working toward compliance or a Pennsylvania resident whose privacy has been violated, our network of Pennsylvania-licensed attorneys can help.
Find a Pennsylvania Privacy Attorney