Breach Notification Timelines — Alaska: Expeditious Notice, 1,000+ CRA Trigger & AG “No-Harm” Filing
Jurisdiction: Alaska (Alaska Personal Information Protection Act, “APIPA”).
Focus: breach notification timelines and operational requirements for businesses and public agencies handling Alaskan residents’ personal information.
Key takeaway: Alaska does not impose a fixed day-count to notify individuals. Notices must be sent in the most expeditious time possible and without unreasonable delay, with limited law-enforcement delay permitted. Special notices apply if 1,000+ residents are affected and when an entity uses the risk-of-harm exception (written notice to the Attorney General and five-year recordkeeping).
1) Who must comply
APIPA applies broadly to any covered person that owns or licenses personal information on Alaska residents. “Covered person” includes (a) a person doing business; (b) a governmental agency; or (c) a person with more than ten employees. Alaska uses the terms information collector (the owner/licensor of PI) and, for certain duties, information distributor and information recipient.
2) What triggers notice (breach + personal information)
A “breach of the security” means unauthorized acquisition—or reasonable belief of such—of personal information that compromises its security, confidentiality, or integrity. Acquisition can occur by physical copying, electronic means, or other methods.
“Personal information” (PI) is an individual’s first name (or first initial) and last name combined with one or more of the following data elements, when the data are not encrypted or redacted, or are encrypted but the encryption key was accessed or acquired:
- Social Security number;
- Driver’s license number or state ID number;
- Financial account, credit card, or debit card number (in many cases with the security code, PIN, or password that permits account access);
- Passwords, PINs, or other access codes for financial accounts.
Good-faith acquisitions by an employee or agent for the entity’s legitimate purposes are generally excluded if the information is not used improperly.
3) Who must be notified
- Affected Alaska residents. Primary audience for breach notifications.
- Consumer reporting agencies (CRAs). If you must notify more than 1,000 Alaska residents, you must also notify all nationwide CRAs without unreasonable delay, providing the timing, distribution, and content of the notices. (Financial institutions subject to GLBA are exempt from this CRA notice obligation.)
- Alaska Attorney General (AG). If, after an appropriate investigation, you determine there is no reasonable likelihood of harm and therefore you will not notify residents, you must send a written notice to the AG and maintain your written determination for five years.
4) Timelines and allowable delays
Baseline timing to individuals: “most expeditious time possible and without unreasonable delay,” consistent with measures to determine scope and restore system integrity.
Law-enforcement delay: You may delay notice if an appropriate law-enforcement agency states that disclosure would interfere with a criminal investigation. Once LE provides written confirmation that notice will no longer interfere, you must notify residents as soon as practicable and without unreasonable delay.
CRA notices (1,000+ residents): Also without unreasonable delay after you determine that such resident notices are required.
AG notice under the harm-threshold exception: Send the written notice to the AG when you conclude you will not notify residents; keep your written determination for 5 years.
| Milestone | What to do | Timing | Notes |
|---|---|---|---|
| T0 – Discovery/notification of breach | Start scoping + containment | Immediately | Document timeline and decisions. |
| Risk-of-harm assessment | Decide if resident notice is required | Promptly during investigation | If deciding no notice, send written notice to AG and keep records 5 years. |
| Resident notices (if required) | Send written/electronic notice, or substitute notice if criteria met | Most expeditious time possible, without unreasonable delay | Delay allowed only for LE interference; notify immediately after LE lifts in writing. |
| CRA notices (1,000+ residents) | Notify all nationwide CRAs of timing, distribution, content | Without unreasonable delay | GLBA-regulated entities are exempt from this CRA notice. |
| Service-provider event | Recipient promptly notifies distributor; distributor takes on notice duties | Promptly; then follow baseline timeline | “Cooperate” by sharing relevant information (except trade secrets/confidential biz info). |
5) How to notify (methods, substitute notice)
Alaska authorizes three methods:
- Written notice sent to the resident’s last known postal address.
- Electronic notice if it is your primary communication channel or if compliant with the federal E-SIGN Act.
- Substitute notice only if you can show that (a) direct notice would cost more than $150,000; or (b) the affected class exceeds 300,000 residents; or (c) you lack sufficient contact information. Substitute notice consists of: (i) email notice if you have email addresses; (ii) conspicuous posting on your website; and (iii) a notice to major statewide media.
6) Content of the notice
APIPA does not prescribe a rigid form, but best practice is to include:
- a clear description of what happened (date range, systems affected);
- the types of PI involved (e.g., SSNs, account numbers);
- what you have done to contain and remediate;
- how residents can protect themselves (credit reports, fraud alerts, freezes);
- contact points (toll-free number, email, postal address); and
- if applicable, details about complimentary monitoring or identity theft assistance.
7) Third-party/service-provider breaches
When an information recipient (e.g., a service provider) experiences a breach involving PI it received from an information distributor (e.g., the data owner), the recipient must promptly notify the distributor and cooperate by sharing relevant breach information. After that notice, the distributor must carry out the resident-notification duties as though the breach occurred on its own systems.
8) Penalties and enforcement
Violations trigger civil penalties. For both governmental and non-governmental information collectors, the state may seek up to $500 per resident not notified (capped at $50,000 total per incident), plus injunctive relief. For non-government entities, violations are treated as unfair or deceptive acts or practices under the Alaska Unfair Trade Practices Act, with monetary damages limited to actual economic losses (subject to statutory caps).
9) Visual: operational timeline (no fixed day-count)
T0 (discovery) → T0–T+ (scope + integrity restoration) → Decision: notify residents or apply risk-of-harm exception (then notify AG + retain records 5 years) → If 1,000+ residents: notify CRAs without unreasonable delay → If LE invokes delay: pause until written clearance, then notify immediately.
Quick Guide — Alaska breach notification (300+ words)
Do I need to notify? If unauthorized acquisition (or a reasonable belief of such) compromises PI of Alaska residents, resident notice is required unless you complete a documented risk-of-harm analysis showing no reasonable likelihood of harm. If you rely on that exception, you must send a written notice to the Alaska Attorney General and keep the written determination for five years.
How fast? There is no fixed day limit. You must notify in the most expeditious time possible and without unreasonable delay, while you determine scope and restore system integrity. You may delay only if law enforcement says notice would compromise an investigation; once LE clears in writing, notify without delay.
Who else gets notice? If you notify 1,000+ Alaska residents, also notify all nationwide CRAs (with timing, distribution, and content of notices). GLBA-regulated financial institutions are exempt from the CRA notice obligation. There is no routine AG notice, except when you decline resident notice based on lack of harm.
How do I notify? Written mail or electronic notice (if it’s your primary channel or E-SIGN-compliant). If cost would exceed $150,000, affected residents exceed 300,000, or contact info is insufficient, you may use substitute notice: (1) email (if available), (2) conspicuous website posting, and (3) statewide media.
What should the notice say? Alaska does not prescribe content, but include: incident date(s) and nature; PI types; steps you’ve taken; steps residents should take (e.g., fraud alerts, freezes); contact information; and any free monitoring offered.
Vendors/service providers? Your vendor must promptly notify you and cooperate. After that, the data owner (information distributor) assumes the legal duty to notify residents as if the breach occurred on its own systems.
Penalties? Up to $500 per resident not notified (capped at $50,000), plus injunctive relief. For private entities, violations are UDAPs with damages limited to actual economic loss per statute.
Documentation tips: Keep a written chronology, your risk-of-harm analysis, copies of notices (resident, CRA, AG), law-enforcement correspondence, and remediation steps. Maintain the “no-harm” determination for at least five years, as required.
FAQ — Alaska breach notification (10)
- Is there a 30- or 45-day deadline? No. Alaska requires notice “as expeditiously as possible and without unreasonable delay,” with LE delay permitted.
- Do I have to notify the Attorney General in every breach? No. AG notice is required only if you decline to notify residents because you determine there is no reasonable likelihood of harm; keep your written determination for five years.
- What if more than 1,000 residents are affected? Notify all nationwide CRAs without unreasonable delay and provide them the timing, distribution, and content of the resident notices.
- Can I email notices? Yes, if email is your primary channel with the resident or if the notice complies with E-SIGN. Otherwise use postal mail. Substitute notice is available if statutory thresholds are met.
- What if the police ask me to hold off? You may delay while LE determines notice would interfere with an investigation. Once LE gives written clearance, notify without unreasonable delay.
- Is encrypted data exempt? Yes, generally; however, if the encryption key was accessed/acquired, the safe harbor may not apply.
- Do vendors have to notify my customers? The service provider must promptly notify you and cooperate. The legal duty to notify residents attaches to the information distributor (data owner).
- Does Alaska define required notice content? No. Use best practices: what happened, what data, what you’re doing, what residents can do, and how to contact you.
- What about non-Alaska residents? Apply the law of each resident’s state. For a multi-state event, coordinate notices to meet the most stringent overlapping requirements.
- What are the penalties? Up to $500 per resident not notified (max $50,000 incident cap) and injunctive relief; for private entities, violations are unfair or deceptive acts with damages limited to actual economic loss.
Technical basis and legal sources (Alaska)
This summary is based on Alaska statutes addressing breach disclosure, allowable delay, notice methods, CRA notice threshold, definitions, service-provider duties, and penalties. See citations below.
- Disclosure and timing; harm-threshold/AG notice; 5-year recordkeeping.
- Allowable LE delay.
- Notice methods and substitute notice thresholds.
- CRA notice (1,000+); GLBA exemption for CRA notice (practice guidance).
- Definitions of covered person, breach, personal information.
- Service-provider/distributor-recipient duties.
- Penalties and UDAP treatment.
Conclusion
In Alaska, speed and documentation drive compliance. Because there is no fixed day-count, regulators will examine whether you acted expeditiously and whether any delay was truly necessary to scope the incident, restore integrity, or comply with a written law-enforcement hold. When you decide resident notice is unnecessary, document the analysis, notify the AG in writing, and retain the file for five years. If 1,000+ residents are affected, remember your CRA notices. Establish vendor obligations up front, rehearse your substitute-notice playbook, and keep precise records—those are the levers that convert a chaotic incident into a compliant response in Alaska.
Disclaimer (does not replace legal counsel): This material is for general information only and does not constitute legal advice, does not create an attorney–client relationship, and may not reflect the most recent changes in law. Consult a qualified attorney for advice about your specific situation.