State Guide
Arkansas Privacy & Data Security Laws
Every statute below can apply to a business handling Arkansas residents' data, depending on your revenue, the number of Arkansas consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
Requires reasonable security procedures and practices, plus secure disposal. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
On the Horizon — Proposed, Not Yet Law · 1
Included specifically as a warning: this is the single most-repeated inaccurate claim found during research, and it's worth knowing it's disputed rather than assuming a secondary source is right.
Status: Genuinely conflicting sources. Arkansas's real 2025 bill (SB 258, the "Arkansas Digital Responsibility, Safety, and Trust Act") died at sine die adjournment on May 5, 2025. Separately, several low-quality secondary sources describe an already-"enacted" Arkansas Personal Data Protection Act (claiming a 2023 signing date and specific 25,000/50%+10,000 thresholds) — but no actual bill number, session-law citation, or Code section could be found to support that claim, which is assessed as likely fabricated or confused with another state.