← All US breach laws·MO

Missouri data breach notification law

Missouri's data breach notification requirements under Mo. Rev. Stat. §407.1500. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Mo. Rev. Stat. §407.1500
Enforcer
Missouri Attorney General
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
Yes — if more than 1,000 Missouri residents are affected, written notice to the AG
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when the breach has caused or is reasonably likely to cause identity theft or other fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Missouri law

First name/initial + last name with SSN, DL/state ID, financial account + access code, unique electronic identifier + password, medical info, health-insurance info

Penalties and enforcement

Civil penalty up to $150,000 per breach under Merchandising Practices Act
Enforced by: Missouri Attorney General. Official regulator page →

Common pitfalls

⚠ Missouri's per-breach (not per-resident) cap can be exhausted quickly in large incidents

Frequently asked questions

How long do I have to notify Missouri residents after a data breach?
Without unreasonable delay
Do I have to notify the Missouri Attorney General?
Yes — if more than 1,000 Missouri residents are affected, written notice to the AG
Does Missouri require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Missouri's breach notification requirement?
Yes — Missouri has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Missouri residents sue me directly for a data breach?
No — Missouri's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Missouri law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, unique electronic identifier + password, medical info, health-insurance info
What are the penalties for failing to comply with Missouri's breach notification law?
Civil penalty up to $150,000 per breach under Merchandising Practices Act

Related state breach laws

Minnesota (MN)
Minn. Stat. §§325E.61
Mississippi (MS)
Miss. Code §75-24-29
Montana (MT)
Mont. Code §§30-14-1701 to 30-14-1736
Nebraska (NE)
Neb. Rev. Stat. §§87-801 to 87-807

Pre-empt the Missouri breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Missouri's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit