EdLaw
Illinois — Personal Information Protection Act (PIPA, 815 ILCS 530)
Illinois' general breach-notification and data-security statute, binding any data collector that owns, licenses, maintains or stores records containing personal information about an Illinois resident. Enacted by P.A. 94-36 (eff. 1 Jan 2006); the data-security duty (§45), the expanded definition of personal information and the Attorney General notification threshold were added by P.A. 99-503 (eff. 1 Jan 2017).
PIPA is the statute SOPPA leans on where student breaches touch the wider population: a school's published breach list must omit student numbers where disclosing them would violate PIPA (SOPPA §27(a)(5)(A)).
Applicability to EdTech
"Data collector" expressly includes public and private universities and corporations (§5), and the duties attach to records about any Illinois resident — not only students — so a vendor's staff, parent and applicant records are in scope alongside pupil data. Two obligations bite hardest on a supplier: the reasonable security duty and the requirement that any contract disclosing personal information flow that duty down to the recipient (§45(a), §45(b)).
Key obligations at a glance
- Notify the affected Illinois resident, at no charge, in the most expedient time possible and without unreasonable delay — §10(a).
- As a vendor holding another entity's data: notify the owner or licensee of the data immediately following discovery — §10(b).
- Notify the Attorney General where a single breach requires notice to more than 500 Illinois residents, with the enumerated incident details — §10(e)(2).
- Notification may be delayed at the request of law enforcement — §10(b-5).
- Implement and maintain reasonable security measures, and require the same by contract of anyone to whom personal information is disclosed — §45(a), §45(b).
- Dispose of materials containing personal information so it cannot be read or reconstructed — §40.
- A waiver of PIPA is void and unenforceable — §15.
- A violation is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act — §20.
Safe harbours. Compliance with the GLBA §501(b) standards satisfies §45 (§45(d)); a HIPAA covered entity or business associate in compliance with the HIPAA/HITECH privacy and security standards is deemed compliant with the act, provided any breach notice given to the Secretary of Health and Human Services is also given to the Illinois Attorney General within 5 business days (§50).
State agencies carry a parallel and stricter regime — the §12 notification variant, annual reporting of breaches to the General Assembly within 5 business days (§25), and secure disposal of data no longer needed (§30).
Contents
| Document | Covers |
|---|---|
| BREACH-NOTIFICATION.md | the whole act — §§1–900: definitions, resident and Attorney General notification, the State-agency variant, waiver, violation, disposal, data security, the HIPAA carve-out |
Licence
The corpus reproduces 815 ILCS 530 in full verbatim from the Illinois General Assembly's compiled-statutes page (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with each section's "(Source: P.A. …)" trailer.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
ilga.gov pages end with the footer "All Rights Reserved" (ilga.gov, read 2026-10-01 through the Internet Archive). The site's Disclaimers page (read the same way, 2026-10-01) sets no terms for reproducing statute text. A site-wide footer of that kind can cover the site, but not the Acts the General Assembly enacts.
Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Illinois SOPPA — the student-specific regime that defers to PIPA on breach disclosure
- SDPC IL-NDPA Exhibit G — §1 requires provider compliance with PIPA by contract; §2 imports PIPA's "personal information" into the definition of Student Data
- Pennsylvania Breach of Personal Information Notification Act — the closest extracted analogue