The general definition of “personal information” or “PI” used in the majority of statutes is: An individual’s first name or first initial and last name plus one or more of following data elements: (i) Social Security number, (ii) driver’s license number or state-issued ID card number, (iii) account number, credit card number or debit card number combined with any security code, access code, PIN or password needed to access an account and generally applies to computerized data that includes PI. When a statute varies from that definition, it will be pointed out and highlighted in the chart.

As of June 1, 2012, Alabama, Kentucky, New Mexico and South Dakota have no laws related to security breach notification.