U.S. Alaska Personal Information Protection Act (AK PIPA)

Why does it matter?

The act sets no fixed number of days for notice. The test is the most expeditious time possible and without unreasonable delay, so the incident record is what shows an entity acted in time.

Key benefits include:

• A clear notice rule

Notify each affected resident when personal information was acquired without authority, unless a documented no-harm determination applies.

• A defined trigger

Personal information is a name combined with a Social Security number, driver's license or state ID number, account or card number, or a password or access code, so teams can scope the data that triggers notice.

• A documented no-harm route

A written determination that harm is not reasonably likely, sent to the Attorney General and kept for five years, can remove the duty to notify residents.

• Clear roles for processors

An information recipient that does not own the data must notify the information distributor immediately and cooperate, so the owner can notify residents.

• Bounded penalties

Civil penalties for failing to notify are up to $500 per resident not notified, capped at $50,000.

How does it work?

Breach disclosure applies when a covered person owns or licenses personal information on an Alaska resident and the security of the system holding it is breached. A breach is unauthorized acquisition, or a reasonable belief of it, that compromises security, confidentiality, or integrity. Acquisition includes photocopying and other paper-based methods, so paper records count. A law enforcement agency may ask for a delay if notice would interfere with a criminal investigation (AS 45.48.020).

Notice goes by written document, or by electronic means when that is the usual channel. If notice would cost more than $150,000, the class exceeds 300,000 residents, or contact details are missing, the entity may use email, website posting, and notice to major statewide media (AS 45.48.030). When more than 1,000 residents are notified, the nationwide consumer credit reporting agencies must be told the timing, distribution, and content of the notices, unless the entity is subject to the Gramm-Leach-Bliley Act (AS 45.48.040).

In SmartSuite, Privacy Management holds the data inventory and assessments, and Workflow Orchestration runs the breach decision, resident notice, and credit reporting agency steps with owners and dates.

Key Elements

• Breach of the security (AS 45.48.090)

Unauthorized acquisition, or a reasonable belief of unauthorized acquisition, of personal information that compromises its security, confidentiality, or integrity. Good-faith acquisition by an employee or agent for a legitimate purpose is not a breach if the information is not misused or further disclosed (AS 45.48.050).

• Personal information (AS 45.48.090)

An individual's first name or initial and last name combined with a Social Security number, driver's license or state ID number, an account, credit, or debit card number (plus any personal code needed to use it), or passwords and access codes for financial accounts. Encrypted or redacted data is outside the definition unless the encryption key was acquired.

• Notice and the no-harm determination (AS 45.48.010)

Notice is due in the most expeditious time possible and without unreasonable delay. Notice to residents is not required if, after investigation and written notice to the Attorney General, the covered person determines harm is not reasonably likely. The determination is documented in writing and kept for five years.

• Distributors and recipients (AS 45.48.070)

An information recipient that does not own the personal information is not required to give resident notice but must notify the information distributor immediately after discovering a breach and cooperate. The distributor then complies as if the breach occurred in its own system.

• Social Security numbers (AS 45.48.400 to .480)

A person may not make a Social Security number available to the general public, print it on an access card, require it over an unsecured internet connection, or print it on mailed material except as allowed. Requesting or collecting it is restricted, with listed exceptions. Knowing violations carry a civil penalty of up to $3,000.

• Disposal of records (AS 45.48.500 to .590)

A business or governmental agency disposing of records with personal information must take all reasonable measures to protect against unauthorized access or use, and must adopt written policies and procedures for destruction and disposal. A knowing violation carries a civil penalty of up to $3,000, and a damaged individual may sue for actual economic damages.

• Security freeze and identity theft (AS 45.48.100 to .290, .600 to .690)

A consumer may place a security freeze on a credit report, and the agency must place it within five business days of a request with proper identification. A victim of identity theft may petition the superior court for a determination of factual innocence.

What does it cover?

The act applies to a person doing business in Alaska, a state or local governmental agency other than the judicial branch, and a person with more than 10 employees that owns or licenses personal information that includes information on an Alaska resident. The breach rules cover personal information in any form. A person who accepts credit or debit cards may not print more than the last four digits of the card number or the expiration date on a point-of-sale receipt (AS 45.48.750).

What are its objectives?

The act sets out what covered entities must do and what residents can rely on.

Notify each affected Alaska resident of a breach in the most expeditious time possible.

Document and keep for five years any determination that harm is not reasonably likely.

Notify the nationwide consumer credit reporting agencies when more than 1,000 residents are notified.

Dispose of records containing personal information with reasonable measures and written policies.

Give residents a credit security freeze and a route to a factual-innocence determination after identity theft.

Framework in Context

AS 45.48 has no general security-program requirement; its security duty is limited to record disposal (AS 45.48.500). Entities subject to the Gramm-Leach-Bliley Act are excused from the credit reporting agency notice (AS 45.48.040). Organizations that operate in several states and under several frameworks map the Alaska duties to a single incident and disposal process.

Common Framework Mappings

Alaska's duties overlap with the frameworks below, which lets one incident and disposal process serve several regimes.

Mapped frameworks include:

CCPA/CPRA

CIS Controls v8.1

GDPR

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2