Blog

Revised Database Security Breach Notification Law

Bottom line, let’s sit down together and review or create some security procedures for your business.

As of August 1, 2018, according to ACT 382 of the Louisiana Revised Statute, "Any person that conducts business in the state or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information, shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Any person that conducts business in the state or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information shall take all reasonable steps to destroy or arrange for the destruction of the records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means."

This opens a big can of worms for many businesses. Thought only banks and hospitals have to deal with database security? Think of the drawers filled with insurance and payroll records, the electronic versions you may have on your server or in your e-mail. If there is "a reasonable likelihood to result in, the unauthorized acquisition of and access to personal information", you have several requirements to fulfill, like notifying the Attorney General within the "most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach"

Bottom line, let's sit down together and review or create some security procedures for your business.

To read the full version, go here: http://legis.la.gov/legis/ViewDocument.aspx?d=1101149