[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is the Florida Information Protection Act (FIPA)? Compliance Tips](/blog/fipa) Publish date December 9, 2025 {x} minute read # What is the Florida Information Protection Act (FIPA)? Compliance Tips [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Cindy Ruan](/team/cindy-ruan) Lead GRC specialist Cindy combines degrees in Computer Science and Law with expertise in GRC, and she has presented her insights at the Australian Cyber Conference. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) [The Florida Information Protection Act of 2014 (FIPA)](https://www.flsenate.gov/Session/Bill/2014/1524) came into effect on July 1, 2014, expanding Florida's existing data breach notification statute requirements for covered entities that acquire, use, store or maintain Floridian's [personal information](https://www.upguard.com/blog/personally-identifiable-information-pii).   FIPA modified Florida's existing data breach notification law and applies to commercial and government entities. ## Who is Covered Under FIPA? FIPA applies to all covered entities. A covered entity is a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity or government entity that acquires, maintains, stores, or uses personal information. More importantly, FIPA is an extraterritorial law, which means any company that acquires, uses, stores, or maintains the [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) of Floridians must comply. This includes covered entities with no physical footprint in Florida. This is an extraterritorial law akin to [CCPA](https://www.upguard.com/blog/what-is-the-ccpa), [GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant), [LGPD](https://www.upguard.com/blog/lgpd), and [the SHIELD Act](https://www.upguard.com/blog/shield-act). This means in the event of a security breach, FIPA will apply to any entity which the personal information of Floridians, regardless of the number of people or volume of data. ## How to Comply With FIPA In addition to the reactive component of FIPA, covered entities must report all data breaches. FIPA also has a proactive component that imposes obligations on covered entities regardless of whether they suffer a breach.   Each covered entity, governmental entity, or third-party agent must take reasonable measures to protect and secure data personal information in electronic form. Additionally, covered entities must take reasonable measures to dispose of or arrange for the disposal of customer records containing PII. Such disposal must involve shredding, erasing, or otherwise modifying the PII in the records to make them unreadable or undecipherable. ### What are the Penalties for Not Complying With FIPA? While FIPA states it does not create a private cause of action, it does contain provisions authorizing Florida's Department of Legal Affairs to bring an enforcement action against entities committing statutory violations. Entities who fail to provide required notices under FIPA violate [Florida Deceptive and Unfair Trade Practices Act (FDUTPA)](http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute\&URL=Ch0501/part02.htm\&StatuteYear=2005\&Title=-%3E2005-%3EChapter%20501-%3EPart%20II) and are subject to non-compliance civil penalties: * $1,000 per day for the first 30 days * $50,000 for each 30-day period up to 180 days * A maximum penalty of $500,000 for violations exceeding 180 days It's important to understand these penalties are enforced for failure to comply with any FIPA notice requirements, including late or incomplete notice, and they do not depend on the number of people affected. ## What are the FIPA Requirements for Third Parties? [Third parties](https://www.upguard.com/blog/third-party-vendor) contracted to maintain, store or process personal information or security systems for covered entities have up to 10 days to report breaches to said entities. Upon receiving notice of the breach, covered entities become responsible for providing the required notices within the stipulated 30-day period. The [third-party agent](https://www.upguard.com/blog/third-party-vendor) may notify affected individuals and the Attorney General on behalf of the covered entity, but the agent’s failure to provide proper notice has been deemed a violation against the covered entity. [This is why vendor risk management is so important](https://www.upguard.com/blog/vendor-risk-management-important). As it turns out, managing third-party and [fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk) is foundational to [cybersecurity](https://www.upguard.com/blog/cyber-security), ensuring business continuity and maintaining regulatory compliance. Effective [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management) can help you comply with FIPA because you will understand your vendor risk profile and be able to mitigate [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) rather than relying on [incident response](https://www.upguard.com/blog/incident-response-plan). ## What are the Data Breach Notification Requirements of FIPA? FIPA reduces the time period allowed for reporting a breach of security to 30 days from 45 days under the previous Florida statute. However, if a good cause is sent in writing to [the Florida Department of Legal Affairs](http://www.myfloridalegal.com/) (or the Florida Office of the Attorney General) within 30 days of determining a breach, FIPA authorizes the department to authorize an additional 15 days to provide notice. Like any notice requirement, prompt coordination with law enforcement agencies is essential. Additionally, law enforcement may delay required notices if they believe it could interfere with ongoing criminal investigations. ### How Will Affected Individuals Be Notified Under FIPA? In the event of a breach involving 500 or more individuals, notice to affected individuals must be made as soon as possible and without unreasonable delay. Additionally, the Department of Legal Affairs must provide a notice of the particulars. For breaches involving 1,000+ individuals, covered entities must send notices to nationwide consumer credit reporting agencies. However, individual notice may not be required if the covered entity determines the breach has not and will not likely result in identity theft or financial harm to the affected individuals. In this situation, covered entities need to provide written determination to the Department of Legal Affairs within 30 days of their decision not to notify affected individuals. Additionally, covered entities subject to federal regulation, such as HIPAA, [GLBA](https://www.upguard.com/blog/glba), and [FISMA](https://www.upguard.com/blog/fisma), may defer notice requirements provided they send the requisite notice to the Department of Legal Affairs. ### What Should Be Included in the Breach Notice to the Department of Legal Affairs? The notice to the Department of Legal Affairs should include the following: * A summary of the events surrounding the breach * How unauthorized access was gained * Any services related to the breach being offered without charge to affected individuals, such as credit reporting, and how individuals can access them * A copy of the notice to affected individuals or an explanation of why a notice was not provided (no risk of financial harm or identity theft) * The name, address, telephone number, and email address of the employee or third party who can provide additional information about the breach Additionally, if the Attorney General requests any of the following, they must be provided: * A police report * An incident report * A [computer forensics](https://www.upguard.com/blog/digital-forensics) report * A copy of the [information security policy](https://www.upguard.com/blog/information-security-policy) in place regarding breaches * Steps that have been taken to rectify the breach, such as improving [data security](https://www.upguard.com/blog/data-security) and data protection efforts ### What Should Be Included in the Notice to Affected Individuals? The notice to affected individuals can take the following forms: * **In writing:** Sent to the mailing address of the individual in the records of the covered entity * **By email:** Sent to the email address of the individual in the records of the covered entity In either form, the notice must include the following: * The date or estimated date range of the breach * A description of what personal information was accessed * How the affected individual can inquire about the breach and their personal information If the cost of direct notice exceeds $250,000, more than 500,000 individuals are impacted, or the covered entity does not have a mailing or email address for affected individuals, then a substitute notice can be provided. The substitute notice must include a conspicuous notice on their website, in print, and to broadcast media where affected individuals reside. ## What Types of Information Does FIPA Protect? FIPA protects personal information and customer records. Personal information means either of the following: * An individual's first name or first initial and last name in combination with: * A social security number * A driver's license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity * A financial account number or credit card or debit card number, in combination with any required security code, access code, or passport that is necessary to access the individual's financial account * Any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional * An individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual * A username or email address, in combination with a password or security question and answer that would permit access to an online account Personal information does not include information about an individual that has been made publicly available by a federal, state, or local government entity. Nor does it include information that is [encrypted](https://www.upguard.com/blog/encryption), secured, or modified by any other method or technology that removes elements that personally identify an individual or otherwise render the information unusable.   Customer records are any material, regardless of form, in which personal information is recorded or preserved by any means, including and not limited to written or spoken words, graphically depicted, printed, or electromagnetically transmitted that are provided by a Floridian to a covered entity to purchase or lease a product or obtaining a service. ## How UpGuard Can Help Meet FIPA Compliance Standards UpGuard's [vendor questionnaire software](https://www.upguard.com/product/vendor-risk/questionnaire-management) can minimize the time your organization spends managing third-party relationships by automating vendor questionnaires and providing [vendor questionnaire templates](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template) that map to the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework) and other best practices. We can help you continuously monitor your vendors' security posture over time while benchmarking them against their industry. Each vendor is rated against 50+ criteria, such as the presence of [SSL](https://www.upguard.com/blog/ssl-certificate) and [DNSSEC](https://www.upguard.com/blog/dnssec), as well as the risk of [domain hijacking](https://www.upguard.com/blog/domain-hijacking), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack), and [email spoofing](https://www.upguard.com/blog/email-spoofing) for [phishing](https://www.upguard.com/blog/phishing). Our platform scores your vendors each day with a [security rating](https://www.upguard.com/blog/what-are-security-ratings) out of 950, and any significant score drops are automatically flagged and alerted. UpGuard also offers a customizable questionnaire builder that allows businesses to meet FIPA compliance requirements. Businesses that follow FIPA rules will be able to manage their data breach risk more efficiently and reduce the likelihood of a security breach from occurring. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)