language: en · status: in-force · last checked: 2026-10-08

Alaska Personal Information Protection Act (AS 45.48)

AS 45.48 "may be cited as the Alaska Personal Information Protection Act" (AS 45.48.995). It was enacted by SCS CSHB 65(FIN) am S (Laws of Alaska 2008), which "takes effect July 1, 2009" apart from two provisions that took effect immediately (enrolled bill, sec. 10, read 2026-10-08). The corpus reproduces two of the chapter's articles plus its general provisions:

• Article 1, breach of security (AS 45.48.010–45.48.090). This binds a covered person, defined as a "(A) person doing business; (B) governmental agency; or (C) person with more than 10 employees" (AS 45.48.090(2)), that owns or licenses personal information on a state resident.
• Article 4, disposal of records (AS 45.48.500–45.48.590). This binds a business and a governmental agency.

Alaska has no student-data-privacy statute (see the research note), so for a vendor handling an Alaska district's data these articles are the state-law breach and security layer.

Applicability to EdTech

• A school district is a covered person, and so is its vendor. "Governmental agency" means "a state or local governmental agency, except for an agency of the judicial branch" (AS 45.48.090(3)). An EdTech company is a "person doing business" (AS 45.48.090(2)(A)).
• A vendor that holds a district's data without owning it is an "information recipient". That is an information collector who does not own, or have the right to license, the personal information it received from an information distributor (AS 45.48.090(6)). On a breach the recipient need not notify residents itself. Instead, "immediately after the information recipient discovers the breach", it must notify the information distributor and cooperate with it (AS 45.48.070(a)). The distributor then notifies as if the breach were its own (AS 45.48.070(b)).
• The trigger is narrow. "Personal information" is a name combined with an SSN, a driver's licence or state ID number, a financial account or card number (with its code where one is needed), or "passwords, personal identification numbers, or other access codes for financial accounts" (AS 45.48.090(7)). Unencrypted student names with ordinary login credentials are not within it. Encrypted data is outside it unless "the encryption key has been accessed or acquired".
• Notice may be skipped only with a written determination. Disclosure is not required if, after investigation and written notice to the attorney general, the covered person determines there is no reasonable likelihood of harm. That determination must be documented and kept for five years (AS 45.48.010(c)).
• Disposal duties. When disposing of records containing personal information, a business and a governmental agency "shall take all reasonable measures necessary to protect against unauthorized access to or use of the records" (AS 45.48.500(a)). Each must adopt written disposal policies (AS 45.48.530). Article 4's definition of "personal information" is wider than Article 1's: it includes a name combined with "medical information, insurance policy number, employment information, or employment history" (AS 45.48.590(4)).

Contents

Not reproduced: Article 2 (credit report and credit score security freeze, AS 45.48.100–45.48.290), Article 3 (protection of social security numbers, AS 45.48.400–45.48.480), Article 5 (factual declaration of innocence after identity theft, AS 45.48.600–45.48.690) and Article 6 (truncation of card information, AS 45.48.750).

Key obligations at a glance

• Disclose a breach to each affected state resident "in the most expeditious time possible and without unreasonable delay" — AS 45.48.010, (b).
• Notify the nationwide consumer credit reporting agencies when more than 1,000 residents are notified — AS 45.48.040(a).
• As an information recipient, notify the information distributor immediately — AS 45.48.070(a).
• Dispose of records securely and keep written disposal policies — AS 45.48.500, AS 45.48.530.

Enforcement

A governmental agency that violates Article 1 is liable for a civil penalty of up to $500 for each resident not notified, capped at $50,000, and the Department of Administration enforces against it (AS 45.48.080(a), (c)). For anyone else, a violation is an unfair or deceptive act or practice under AS 45.50.471–45.50.561, with the same penalty cap and limited damages (AS 45.48.080(b)). A knowing violation of Article 4 carries a civil penalty of up to $3,000 (AS 45.48.550(a)). An individual damaged by an Article 4 violation may sue (AS 45.48.560). A waiver of Article 1 is void (AS 45.48.060).

Licence

The reproduced text is AS 45.48 as enacted by the Alaska Legislature, served on the Legislature's statutes site, whose pages carry no copyright notice or reproduction terms (read 2026-10-08). No copyright subsists in statute text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". The corpus reproduces section numbers, catchlines and text, and nothing else from the site.

Conditions: none. The corpus names the source in Sources and in each section's {.meta} provenance line.

Related

• Alaska — student data (research note) — why there is no Alaska student-privacy statute to extract
• AS 14.03.110 and 14.03.115 — Alaska's school survey and parent records-access sections
• Alabama Data Breach Act — a breach statute with an explicit third-party-agent notice clock, for comparison
• FERPA — the federal education-records layer

Sources

• Alaska Legislature — Alaska Statutes AS 45.48 (print view, Article 1)
• Alaska Legislature — Alaska Statutes AS 45.48 (print view, Article 4)
• Alaska Legislature — Alaska Statutes AS 45.48 (print view, Article 7)
• Laws of Alaska 2008 — SCS CSHB 65(FIN) am S, enrolled — the enacting act and its effective-date section