State Guide
Pennsylvania Privacy & Data Security Laws
Every statute below can apply to a business handling Pennsylvania residents' data, depending on your revenue, the number of Pennsylvania consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
Requires notifying affected residents (and often the state AG/regulator) after a breach of unencrypted personal information such as SSNs, driver's license/state ID numbers, or financial account numbers. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
On the Horizon — Proposed, Not Yet Law · 1
Second-highest priority to re-check after Massachusetts. The Senate amended the House bill in June 2026 — notably raising the controller threshold from 50,000 to 100,000 consumers — so even after Senate passage it would still need House concurrence.
Status: Passed the PA House 127-76 (Oct 1, 2025); referred to Senate Consumer Protection & Professional Licensure (Oct 3, 2025); reported and re-referred to Communications & Technology (Feb 4, 2026); re-reported as amended, first consideration (Jun 24, 2026); second consideration (Jun 25, 2026). No final Senate passage, no House concurrence on the Senate amendments, no Act number. Re-verified against palegis.us Sep 11, 2026 — still sitting after second consideration.