There are specific considerations when determining if a breach is reportable. Upon becoming aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. Notifications may only be given by specific methods. In addition, Wyoming has separate substitute notice allowances based on businesses operating in-state or out-of-state.

Wyoming’s data breach notification law allows the organization and the vendor to decide who will be responsible to perform the consumer notification. If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.

The Attorney General may bring an action for compliance and/or recover damages for violations of the breach notification requirements. Organizations may be fined or penalized for Vendor violations.

Vendors must notify Organizations as soon as practicable after discovery of a breach or suspected breach. The Organization is responsible for submitting any required regulatory reporting and consumer notifications.