New Pennsylvania law will offer added protections for victims of data breaches and new reporting requirements

Pennsylvania enacted Act 33 of 2024, strengthening data breach notification rules by requiring impacted organizations to provide a free credit report and one year of credit monitoring to affected consumers, and to notify the Pennsylvania Attorney General when more than 500 Commonwealth residents are impacted, including specified incident details; entities governed by 40 Pa.C.S. Ch. 45 are exempt from the AG notice, and it remains unclear whether submitted reports will be published online.