State Guide
Pennsylvania Privacy & Data Security Laws
Every statute below can apply to a business handling Pennsylvania residents' data, depending on your revenue, the number of Pennsylvania consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
Requires notifying affected residents (and often the state AG/regulator) after a breach of unencrypted personal information such as SSNs, driver's license/state ID numbers, or financial account numbers. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
On the Horizon — Proposed, Not Yet Law · 1
Second-highest priority to re-check after Massachusetts — it has cleared committee and is on the Senate floor calendar.
Status: Passed the PA House 127-76 (Oct 1, 2025); Senate Communications & Technology Committee reported it favorably 14-0 (Feb 4, 2026); as of the most recent evidence found it was "Engrossed" and under a second Senate consideration — closer to passage than any other non-enacted state.