Michigan Data Breach Law: What Small Businesses Must Do After a Breach

Your IT provider calls on a Tuesday. Someone got into the office manager’s email two weeks ago, and that mailbox holds scanned W-2s and a few copies of driver’s licenses. The first question is technical. The second one is legal: who do you have to tell?

In Michigan, the answer starts with the Identity Theft Protection Act, and in particular one section of it, MCL 445.72. It applies to businesses of every size, and it has not changed since 2011.^[1] Data breaches are not just a big-company problem: in Verizon’s 2025 data, ransomware was part of 88% of breaches at small and mid-sized businesses, ^[2] In about half of the ransomware cases Sophos investigated, attackers were confirmed to have stolen data, and stolen data is what triggers notice.^[3]

Here is what the law requires in plain English, who else you may have to notify, what is likely to change, and what to do in the first days after a breach.

Does Michigan’s breach law apply to your business?

Almost certainly. It applies to any individual, partnership, corporation, LLC or other organization that owns or licenses computerized personal information about Michigan residents.^[4] There is no size threshold. A 12-person accounting office is covered the same as a hospital system.

What matters is the kind of data. Under Michigan law, “personal information” means a person’s first name or first initial and last name, linked to at least one of the items below.^[4]

The list is narrow compared with many states, and it may grow (see what’s changing). Data outside it can still be covered by HIPAA, federal financial rules or other states’ laws.

What counts as a “security breach”?

Michigan defines a breach as the unauthorized access and acquisition of that data in a way that compromises its security or confidentiality.^[4] A few details matter:

• Encrypted data is a safe harbor, unless the attacker also got the encryption key.^[1]
• Redacted data is not covered, meaning no more than the last four digits of a license or account number, or five digits of a Social Security number, are visible.^[4]
• An employee who looks at data in good faith for work, and does not misuse or share it, has not caused a breach.^[4]

The “likely harm” exception

You do not have to notify people if you determine the breach has not caused and is not likely to cause substantial loss or injury, or identity theft. That decision has to be made with the care “an ordinarily prudent person” would use in the same position.^[1] In practice, that means you need facts from a real investigation, not a hunch, and you should write down how you reached the decision. Make this call with your attorney.

Who you have to notify

Michigan residents come first, but depending on your size, industry and customers, the list can be longer.

Michigan’s law protects Michigan residents. If you have customers or employees in Ohio, Indiana, Illinois or anywhere else, each of their states’ laws applies to them, and some set firm deadlines or require notice to the state Attorney General.

How fast do you have to notify?

Michigan sets no fixed number of days. The law says “without unreasonable delay,” and allows a delay only for two reasons:^[1]

• You need time to figure out the scope of the breach and restore the reasonable integrity of your systems, after which you must notify without unreasonable delay.
• A law enforcement agency tells you that notice would impede a criminal or civil investigation, or national security.

“No deadline” is not the same as “no hurry.” Other laws do set the clock: 30 days for the FTC under the Safeguards Rule, 60 days under HIPAA, 10 business days for insurance licensees, and a proposed 45 days under the pending Michigan bills described below. If people in other states are affected, their states’ deadlines apply to them.

How to notify, and what the notice must say

Michigan allows notice by mail, by email (if the person agreed to email notices, you already email them regularly, or you do business mainly online), or by phone with a live person, not a recording.^[1] If notice would cost more than $250,000 or reach more than 500,000 Michigan residents, a “substitute notice” of email, a website posting and statewide media is allowed instead.

Every notice must, in clear language:^[1]

1. Describe the breach in general terms
2. Describe the type of personal information involved
3. Say what you have done to protect data from further breaches, if applicable
4. Give a phone number people can call for help or more information
5. Remind people to stay alert for fraud and identity theft

You can also arrange for someone else to send notices for you. When Michigan-based 700Credit had a breach affecting more than 160,000 Michiganders in 2025, the company mailed notice letters on behalf of its auto dealer clients.^[9]

What happens if you don’t notify?

A business that knowingly fails to give a required notice can be ordered to pay a civil fine of up to $250 for each failure, up to $750,000 for a single breach. The Attorney General or a county prosecutor can bring the case.^[1] The law also makes it a misdemeanor to send a fake breach notice with intent to defraud, and it says these penalties do not limit any other civil claims under state or federal law.^[1]

The fine is rarely the biggest cost. The investigation, the downtime, the notice letters, the credit monitoring many businesses choose to offer and the hit to your reputation usually cost more. IBM’s 2026 study put the global average cost of a breach at $4.99 million, though its sample leans toward larger organizations.^[10]

What’s changing: Senate Bills 360-364

Michigan’s breach law has not been updated since 2011, and the Attorney General has asked the Legislature to modernize it.^[5] Senate Bills 360-364 passed the Michigan Senate 19-15 in August 2025 and were sent to the House Government Operations Committee, where they were still waiting as of October 20, 2026.^[11] They are not law. As passed by the Senate, they would:^[12]

• Set a deadline of 45 days after a breach is determined
• Require notice to the Attorney General when 100 or more Michigan residents are notified
• Expand “personal information” to include medical and health insurance information, passport numbers, biometrics, and usernames or email addresses with passwords, and cover paper records
• Require businesses to keep reasonable security procedures, scaled to their size, with a named security coordinator and a risk assessment
• Require 24 months of free identity theft protection when Social Security or taxpayer ID numbers are involved

Even before anything passes, those points are a good preview of what “reasonable” looks like. A business that already meets them will have an easier time if the law changes.

What to do in the first days after a breach

The order matters. Containing the damage and protecting evidence comes before notice, and notice decisions come after you know the facts.

1. 01

   Contain it.

   Take affected computers offline, but do not turn them off until investigators have looked at them. Change passwords and lock compromised accounts.^[13]

2. 02

   Call your team.

   Your IT provider, your cyber insurer (many policies require early notice) and an attorney who handles data breaches. Our guide to cyber insurance for Michigan businesses explains how coverage usually works.

3. 03

   Preserve evidence.

   Keep logs, emails and affected systems as they are. The FTC’s guidance is blunt: do not destroy evidence.^[13]

4. 04

   Find out what was taken, and whose.

   Which records, which data fields, encrypted or not, and where each affected person lives. That last part decides which states’ laws apply.

5. 05

   Make the notice decision with your attorney.

   Decide whether the likely-harm exception applies, write down why, and check federal and insurance rules that may apply to your industry.

6. 06

   Notify the right people.

   Residents, the credit bureaus if more than 1,000 are notified, the data owner if you are a vendor, and any regulators that apply. The FTC’s guide also suggests contacting law enforcement.^[13]

7. 07

   Fix the cause, and keep less.

   Close the hole that let the attacker in. Michigan law already requires businesses to destroy personal data they remove from a database and no longer need, so a smaller pile of data is both safer and required.^[14]

Print or save as PDFOpens a one-page breach response checklist to print or save. Keep a copy with your incident plan.

How to make a breach less likely, and less costly

1. Encrypt laptops and sensitive files. Encryption is the cleanest safe harbor in Michigan’s law. Yet only 37% of breached organizations in IBM’s 2026 study encrypted sensitive data both at rest and in transit.^[10]
2. Keep less data. Old scans of IDs and tax forms in someone’s inbox are a liability. Michigan already requires you to destroy personal data you no longer need.^[14]
3. Know your vendors. In Verizon’s 2026 data, 55% of breaches at smaller organizations involved a third party.^[15] Know which vendors hold your data and what their contracts say about breach notice.
4. Lock down email. Many small-business breaches start with one stolen password. See what to do if someone clicks a phishing link, and how a ransomware attack unfolds.
5. Write the plan down now. Who to call, in what order, with phone numbers. The checklist above is a start.

The free Cyber Insurance Readiness Check scores many of the same basics in a few minutes.

Frequently asked questions