Enforcement: Penalties and Private Rights of Action

Covered entities in all 50 states face civil penalties for violations. In about one-third, the attorney general (or appropriate agency) can impose fines, often with a maximum cap per breach - $750,000 being the highest noted (Michigan). A minority impose a fine per day for noncompliance, and a few include criminal penalties for egregious conduct such as giving notice with intent to defraud.

Nearly 15 states grant a private right of action. Recovery is often capped at actual damages plus attorneys' fees and costs. Businesses harmed by a breach (e.g., banks replacing stolen card numbers) also commonly sue.