language: en · status: in-force · last checked: 2026-09-07

Pennsylvania — Breach of Personal Information Notification Act

Pennsylvania has no dedicated student-privacy statute. Its operative layer is the Breach of Personal Information Notification Act — the act of Dec. 22, 2005, P.L. 474, No. 94 (73 P.S. §2301 et seq.), substantially rewritten by Act 151 of 2022 and amended again by Act 33 of 2024. It requires an entity that maintains or stores computerised personal information to notify affected Pennsylvania residents of a breach of the security of the system, and it now sets sharply shorter deadlines for public bodies — including schools — than for anyone else.

Applicability to EdTech

• "Entity" includes a vendor: "A State agency, a political subdivision of the Commonwealth or an individual or a business doing business in this Commonwealth" (§2). Selling into Pennsylvania districts puts us in scope directly, not only through the district's contract.
• The vendor-specific rule is §3(c), and its trigger is discovery: "A vendor that maintains, stores or manages computerized data on behalf of another entity shall provide notice of any breach of the security of the system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data. The entity shall be responsible for making the determinations and discharging any remaining duties under this act" (§3(c)). Two things follow: our clock starts at discovery — knowledge or reasonable suspicion — which is earlier than the district's, whose seven days run from determination; and the district, not the vendor, owns the determination and the downstream notices. This is the clause a district's incident terms are really invoking.
• A public school has seven business days, and the district attorney three. Where a county, public school or municipality is the subject of a breach, notice under §3(a) must be given within seven business days following determination, and the district attorney for the county where the breach occurred must be notified within three business days — and this applies "notwithstanding the existence of procedures and policies under section 7" (§3(a.2)). "Public school" is defined broadly: any school district, intermediate unit, charter school, cyber charter school or area career and technical school (§3(d)). A vendor that detects an incident must therefore get the district actionable facts in days, not weeks — this is the tightest school-facing breach clock in the US portion of this corpus.
• Two defined moments drive the clock: "Discovery" (knowledge of or reasonable suspicion that a breach has occurred) and "Determination" (verification or reasonable certainty that one has) — both added in 2022 (§2). The seven-day clock runs from determination, not discovery.
• Encryption and data-storage policy duties (§§5.1–5.2) are narrower than they look: both are addressed to "an entity that maintains, stores or manages computerized data on behalf of the Commonwealth", not to every entity in scope for notification, and both require annual review of the policy (§5.1, §5.2). They bite on Commonwealth work, and are a sensible baseline to be able to evidence regardless.
• Personal information is defined without a biometric limb (§2) — unlike Texas, Washington or Florida, Pennsylvania's breach statute does not treat biometric identifiers as a triggering data category. The 2022 and 2024 amendments added medical information (only "in the possession of a State agency or State agency contractor"), health-insurance information, and a user name or e-mail address in combination with a password or security question and answer — that last limb is the one an EdTech account system is most likely to trip.
• §7 lets an entity's own notification procedures substitute for those of the act, if consistent with its timing requirements (§7) — but note §3(a.2) expressly overrides §7 for the public-body deadlines.

Contents

Key obligations at a glance

• Notify affected residents without unreasonable delay following determination — §3(a).
• Seven business days for a county, public school or municipality; three business days to the district attorney — §3(a.2).
• As a vendor holding another entity's data: notify that entity following discovery — §3(c).
• Notify all nationwide consumer reporting agencies where notice goes to more than 500 persons at one time — §5.
• Notify the Office of Attorney General concurrently where notice must go to more than 500 affected Pennsylvania individuals, with the enumerated incident details — §3(c.1).
• Encryption policy, annually reviewed, for data held on behalf of the Commonwealth — §5.1.
• Data storage policy, annually reviewed, on the same footing — §5.2.

Enforcement

A violation is deemed an unfair or deceptive act or practice under the Unfair Trade Practices and Consumer Protection Law, and the Office of Attorney General has exclusive authority to bring the action (§8). The act sets no separate penalty ceiling and creates no private right of action. PDE guidance to districts is not extracted in this corpus; collect it when a Pennsylvania district question lands.

Licence

The reproduced text is the Breach of Personal Information Notification Act (Act 94 of 2005, 73 P.S. §2301 et seq.), enacted by the Pennsylvania General Assembly and served by the General Assembly on legis.state.pa.us. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The reproduced pages carry no copyright notice or terms of use (checked 2026-10-01 against the live pages or the builder's cached copies).

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Pennsylvania General Assembly endorses the corpus.

Related

• Texas school cybersecurity (§11.175) — the other school-facing incident-reporting duty here, with no fixed clock
• Puerto Rico Ley 111-2005 — breach notification whose "entidad" expressly includes every educational institution
• Puerto Rico Ley 40-2024 — the corpus's other short fixed clock (48 hours to PRITS), binding contractors
• NIST CSF — the framework a district's incident-response requirements are usually written against
• FERPA — the federal education-records layer, which carries no breach-notification duty of its own

Sources

• Pennsylvania General Assembly — Act 94 of 2005, unconsolidated statutes (current text as amended)