Privacy Law Library

Florida Information Protection Act of 2014

FIPA

Breach notification · Data security · Biometric · Location

Florida's data breach and data security law. It requires businesses to reasonably secure electronic personal information and dispose of customer records securely, and to notify affected Floridians and, for breaches affecting 500 or more Floridians, the Attorney General, within 30 days. Personal information includes biometric data and geolocation (added by SB 262, effective July 1, 2024).

Where

Florida

Citation

Fla. Stat. 501.171

Status

In force

In force since

2014-07-01

Last amended

2026-04-23

Enforced by

Florida Department of Legal Affairs (Attorney General)

People can sue

No

Penalties

Violations are unfair or deceptive trade practices in department actions. Failure to give required breach notice adds a civil penalty of $1,000 per day for the first 30 days, $50,000 for each later 30-day period up to 180 days, and up to $500,000 beyond 180 days, per breach (501.171(9)). No private cause of action (501.171(10)).

Applies to

• Covered entities: commercial entities that acquire, maintain, store, or use personal information; state governmental entities for notice purposes (501.171(1)(b), (f))
• Third-party agents that maintain, store, or process personal information for a covered or governmental entity (501.171(1)(h))