Blue Tree Technology®
SCHEDULE YOUR FREE 15-MINUTE DISCOVERY CALLSupport CenterSupport: 816-994-8282Sales: 816-256-2595

Compliance, insurance & audit evidence

What Do Missouri and Kansas Require After a Data Breach?

Published · Last reviewed · Next review due:

Both states require businesses to notify affected residents when certain personal information is exposed in a security breach, and both call for notice without unreasonable delay. Because Kansas City businesses often have clients, employees or offices on both sides of State Line, you may need to consider both laws, plus the laws of any other state where affected people live, and any federal rules for your industry. The most practical advice is to involve your attorney and your IT provider as soon as you suspect a breach, because the investigation shapes what you're required to do.

This is a general overview, not legal advice. Laws change, and the details matter. Talk to your attorney about your situation.

What counts as "personal information"

Both laws focus on a person's name combined with sensitive data elements, such as a Social Security number, a driver's license number or a financial account or credit/debit card number. For financial account or credit/debit card numbers, Missouri requires the code needed to access the account; Kansas does not require an access code. Missouri's definition also includes medical information and health insurance information. Encrypted data is generally treated differently, which is one reason encryption matters. Kansas exempts redacted as well as encrypted data, subject to the statute's conditions.

Missouri at a glance (RSMo 407.1500)

  • Notify affected Missouri residents without unreasonable delay, consistent with law enforcement needs and the time needed to determine the scope of the breach.
  • The notice must include, at minimum, a general description of the incident, the type of information involved, a phone number for assistance if one exists, contact information for consumer reporting agencies and advice to monitor statements and credit reports.
  • If notice goes to more than 1,000 Missouri consumers at one time, also notify the Missouri Attorney General's office and the nationwide consumer reporting agencies.
  • Notice may not be required if, after an appropriate investigation or consultation with law enforcement, the business determines that identity theft or fraud isn't reasonably likely. That determination must be documented in writing and kept for five years.
  • A vendor holding data on someone else's behalf must notify the data owner immediately after discovering a breach.

Kansas at a glance (K.S.A. 50-7a02)

  • When a business becomes aware of a breach, it must conduct a reasonable and prompt good-faith investigation into whether personal information has been or will be misused.
  • If misuse has occurred or is reasonably likely, notify affected Kansas residents as soon as possible and without unreasonable delay.
  • If more than 1,000 consumers must be notified at one time, also notify the nationwide consumer reporting agencies.
  • A business that maintains data it doesn't own must notify the owner after discovering a breach.

Federal rules may apply too

What to do in the first days

  1. Contain the incident with your IT provider, and preserve evidence.
  2. Call your attorney and, if you have it, your cyber insurer early.
  3. Work out what data was involved and whose, including which states those people live in.
  4. Document decisions, including any decision that notice isn't required.
  5. Coordinate notices so the wording, timing and recipients are right.

Your incident response plan should already name these steps and who handles them. See 6 things every incident response plan needs.

FAQ

We're in Missouri, but some clients live in Kansas. Which law applies?

Generally, the laws of the states where affected people live matter, so you may need to consider both, and others. Ask your attorney.

Is a lost encrypted laptop a breach?

Both laws treat encrypted data differently, but the details, including whether the key was also exposed, matter. Get advice.

Can our IT provider make the notification decision?

No. Your IT provider helps investigate and document what happened. The legal decision belongs to the business and its counsel. As a vendor, your IT provider must notify the data owner when it discovers a breach in data it holds for them.

Verification sources

Still have a question?

Ask Little Sprout for general information. To get your incident plan and evidence in order before you need them, schedule a free 15-minute discovery call.

Back to the Knowledge Hub

More in this topic

Discuss your business technology needs

Review your priorities with Blue Tree Technology®.

Schedule a discovery call