Michigan's Data Breach Notification Law: What Every Small Business Must Know in 2026

Updated April 2026 | By Evolv Technology Solutions, Grand Rapids, MI

If your small business stores customer names, Social Security numbers, driver's license numbers, financial account information, or medical records — and most businesses do — Michigan law requires you to notify affected individuals if that data is ever compromised.

Yet the majority of small business owners in West Michigan we speak with have never read the law, don't know the timelines, and have no breach response plan in place. That's a liability waiting to happen.

Here's what you need to know.

What Is Michigan's Data Breach Notification Law?

Michigan's Identity Theft Protection Act (PA 329 of 2006) requires any person or business that owns or licenses personal data to notify Michigan residents if their unencrypted personal information is accessed by an unauthorized party.

The law applies to businesses of every size — there is no small business exemption. If you have even one customer whose data is breached, you must comply.

What Triggers a Notification Requirement?

A notification is required when there is unauthorized access to unencrypted (or encrypted where the key was also compromised) personal information that includes a Michigan resident's name combined with any of the following:

• Social Security number
• Driver's license or state ID number
• Financial account number (with access codes, PINs, or passwords)
• Medical or health insurance information

If the data was encrypted and the encryption key was not compromised, notification is generally not required. This is one of the strongest arguments for encryption-at-rest across all your systems.

Notification Timelines and Requirements

Michigan law requires notification "without unreasonable delay." While the statute does not specify an exact number of days (unlike some states with 30- or 60-day deadlines), regulators interpret this strictly. In practice, you should aim to notify within 45 days of discovering the breach.

Notification must be provided to:

1. Each affected Michigan resident — via written notice, electronic notice (if consistent with the E-SIGN Act), or substitute notice if costs exceed $250,000 or more than 500,000 residents are affected.
2. Consumer reporting agencies — if more than 1,000 residents are affected, you must also notify all three major credit bureaus.

What Are the Penalties?

Failure to comply can result in:

• Fines up to $250 per violation per day for failure to notify individuals
• Maximum aggregate penalty of $750,000 per breach event
• Civil liability from affected individuals seeking damages
• Reputational harm that often exceeds the financial penalties

For a small business, even a modest breach affecting 100 customers could result in tens of thousands of dollars in penalties and legal costs.

Why This Matters More in 2026 Than Ever Before

Several trends are making Michigan's breach law more relevant for small businesses right now:

Cyber insurance carriers are auditing compliance. If you cannot demonstrate that you have a breach response plan that complies with state law, your claim may be denied — or your policy may not be renewed.

AI-powered attacks are targeting SMBs. Ransomware groups and phishing operations increasingly use AI to craft convincing attacks targeting small businesses, which typically have weaker defenses than enterprises.

Michigan legislators are considering updates. Proposals to add stricter timelines, expand the definition of personal information to include biometric data, and increase penalties are under discussion in Lansing. Businesses that are compliant now will have an easier transition.

How to Protect Your Business: A Practical Compliance Checklist

Here's what every West Michigan small business should have in place:

Encrypt everything. Encryption is your strongest legal defense. If breached data was properly encrypted, notification may not be required.

Create a written breach response plan. Document who is responsible for what, notification templates, and the steps you'll take within the first 24, 48, and 72 hours of discovering a breach.

Implement access controls. Limit who can access sensitive personal information. Use multi-factor authentication (MFA) on every system that stores customer data.

Deploy endpoint detection and response (EDR). Traditional antivirus is not enough. EDR tools detect and contain threats before they become breaches.

Partner with a managed cybersecurity provider. A Cybersecurity-as-a-Service (CaaS) partner like Evolv provides 24/7 monitoring, incident response, and compliance support — so you're not scrambling when a breach occurs.

Train your employees. The majority of breaches start with a phishing email. Regular security awareness training is one of the most cost-effective defenses available.

Frequently Asked Questions

Does Michigan's data breach law apply to my small business? Yes. There is no size exemption. If your business owns or licenses personal information of Michigan residents and a breach occurs, you must comply with notification requirements.

How quickly do I need to notify people after a breach? Michigan requires notification "without unreasonable delay." Best practice is within 45 days of discovering the breach. Some pending legislative proposals would make this a hard 45-day deadline.

What happens if I don't notify after a breach? You face fines up to $250 per violation per day, a maximum aggregate penalty of $750,000 per breach, and potential civil lawsuits from affected individuals.

Does encryption protect me from the notification requirement? In most cases, yes. If the breached data was properly encrypted and the encryption key was not compromised, Michigan law generally does not require notification.

Do I need to notify credit bureaus? Only if more than 1,000 Michigan residents are affected. You must notify all three major consumer reporting agencies.

What's the difference between Michigan's law and federal requirements? Michigan's law is state-specific and applies broadly. Federal requirements (like HIPAA for healthcare or GLBA for financial services) may add additional obligations depending on your industry. You may need to comply with both.

Can a managed cybersecurity provider help me comply? Absolutely. A CaaS provider like Evolv Technology Solutions handles breach detection, response planning, encryption management, and compliance documentation — so you're protected before, during, and after a potential breach.

---

Don't Wait for a Breach to Get Compliant

Michigan's data breach law isn't new, but the threat landscape in 2026 makes compliance more urgent than ever. The cost of prevention is a fraction of the cost of a breach.

Evolv Technology Solutions helps small businesses across Grand Rapids and West Michigan build cybersecurity programs that keep you compliant, protected, and prepared. Get started with a free security assessment →

Evolv Technology Solutions is a cybersecurity-first managed service provider based in Grand Rapids, Michigan, serving small and mid-sized businesses across West Michigan.