Can I avoid having a data breach response plan in Pennsylvania? What are the requirements?

Data Breach Response Plan Requirements in Pennsylvania

In Pennsylvania, entities that maintain, store, or manage personal information are required to develop and implement a data breach response plan ^[3.4]. The plan must include procedures for responding to and containing a breach, as well as for notifying affected individuals and regulatory authorities ^[3.4].

There are no provisions in Pennsylvania law that allow entities to avoid having a data breach response plan ^[3.4]. Therefore, it is recommended that all entities subject to the data breach notification law develop and implement a data breach response plan.

Conclusion

Entities that maintain, store, or manage personal information in Pennsylvania are required to develop and implement a data breach response plan. There are no provisions in Pennsylvania law that allow entities to avoid having a data breach response plan.

Source(s):

• [3.4] Principles governing data access.

Jurisdiction

Pennsylvania

• Privacy