AK PIPA

No changes recorded yet — we are watching, and nothing has been published.

1. 2009-07-01 AS 45.48 (enacted by chapter 92 SLA 08) takes effect, apart from two earlier sections
2. 2008-06-13 HB 65 signed into law as chapter 92 SLA 08

1. 2008-06-13
   Chapter 92 SLA 08 (HB 65) Major version

   HB 65 of the 25th Legislature, signed on 13 June 2008, created AS 45.48 on breach notification, security freezes, social security numbers and disposal of records. source

   More

   • Apart from two sections that took effect immediately, the Act took effect on 1 July 2009.

Businesses, governmental agencies and larger employers holding personal information on Alaska residents, in any form, must notify residents of a breach.

Who

A "covered person": a person doing business, a state or local governmental agency (except the judicial branch), or a person with more than 10 employees (AS 45.48.090). source

Any form

The duty covers personal information "in any form", and a breach includes acquisition by photocopying, fax or other paper-based methods as well as by computer (AS 45.48.090). source

Personal information

A name combined with a social security number, driver's licence or state ID number, account or card number (with any required code), or financial-account passwords or PINs, when not encrypted or redacted or when the encryption key was also acquired. source

Other duties

The chapter also governs credit report security freezes (article 2), use of social security numbers (article 3) and disposal of records (article 4). source

The holder decides whether a breach occurred and notifies residents itself; a no-harm determination must be documented and sent to the Attorney General.

Notice timing

In the most expeditious time possible and without unreasonable delay, subject to a law enforcement delay and to the time needed to determine the scope of the breach (AS 45.48.010, 45.48.020). source

No-harm determination

Notice is not required if, after an appropriate investigation and written notification to the Attorney General, the covered person determines there is no reasonable likelihood of harm; the determination must be documented and kept for five years. source

Credit agencies

If more than 1,000 Alaska residents must be notified, nationwide consumer credit reporting agencies must also be notified, unless the collector is subject to Gramm-Leach-Bliley (AS 45.48.040). source

Disposal

Records containing personal information must be disposed of so that the information cannot be read or reconstructed, with policies and due diligence over disposal contractors (AS 45.48.500 to 45.48.530). source

Failures to notify carry civil penalties of up to $500 per unnotified resident, capped at $50,000; disposal violations carry penalties of up to $3,000.

Businesses

A breach-notification violation by a non-governmental collector is an unfair or deceptive act or practice under AS 45.50.471 to 45.50.561, with the penalty and damages limits of AS 45.48.080(b). source

Agencies

The Department of Administration may enforce against governmental agencies, which may also be enjoined (AS 45.48.080(a), (c)). source

Private damages

An individual damaged by a disposal violation may sue for actual economic damages, costs and full reasonable attorney fees (AS 45.48.560). source

1. Law text Alaska Statutes chapter 45.48 – Personal Information Protection
2. Law text HB 65 (25th Legislature), enrolled text – chapter 92 SLA 08
3. Guidance HB 65 bill history (25th Legislature)

1. CA SB 1386

   California's breach statute covers computerised data only and sets a 30-day deadline; Alaska's covers personal information in any form, including paper.

2. TX BC 521

   Texas sets a 60-day deadline for individuals and a 30-day report to the Attorney General for breaches of 250 or more Texans; Alaska requires notice without unreasonable delay.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to AK PIPA (RSS)