Managed IT & Cybersecurity in Bozeman, MT

The law generally requires that business to notify any Montana resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice must be given without unreasonable delay, consistent with the legitimate needs of law enforcement or with measures needed to determine the scope of the breach and restore the reasonable integrity of the data system.

A breach under this statute is more than unauthorized access alone. It is unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information and that causes, or is reasonably believed to cause, loss or injury to a Montana resident. Personal information includes an individual's name together with data such as a Social Security number, a driver's license, state identification, or tribal identification number, a financial account or payment card number with an access code, medical record information, a taxpayer identification number, or an IRS identity protection PIN.

When a business is required to notify individuals, it must also send an electronic copy of the notice, at the same time, to the Attorney General's Consumer Protection Office, along with the date and method of distribution. That copy should not include information that identifies the people who received the notice. A separate statute, MCA section 2-6-1503, applies to state agencies and to third parties that receive personal information from a state agency to perform a state function. Those parties have their own notification duties and must also maintain an information security policy and breach notification procedures.

This is general information about the law, not legal advice. Your organization remains responsible for its own compliance program. We help you implement and document the security controls, monitoring, backups, and incident response plan that program depends on.