Governance, risk & compliance
Illinois state privacy and security law (sector tiers) Illinois law as read 23 Oct 2026
Illinois privacy, security and records law that goes beyond the federal and other state frameworks already in the library, arranged in sector tiers.
Choose Privacy general plus every sector that applies. Privacy general (every organization holding Illinois residents’ information): the Personal Information Protection Act, 815 ILCS 530, with its duty to “implement and maintain reasonable security measures” (s.
45), disposal rules backed by Attorney General civil penalties (s. 40), and breach notice “in the most expedient time possible and without unreasonable delay”, with Attorney General notice above 500 Illinois residents (s.
10); the Genetic Information Privacy Act, 410 ILCS 513; and the Human Rights Act rules on artificial intelligence in employment (775 ILCS 5/2-102(L), in force 1 January 2026) with the Artificial Intelligence Video Interview Act, 820 ILCS 42. Insurance: the Insurance Information and Privacy Protection Act (215 ILCS 5/Article XL, in particular ss.
1004, 1005, 1009, 1011 and 1014) and the Insurance Data Security Law, 215 ILCS 215 (P. A.
103-142, in force 1 January 2024; notice to the Director within 3 business days). Finance: customer financial records under s.
48. 1 of the Illinois Banking Act.
Health: the Mental Health and Developmental Disabilities Confidentiality Act, the AIDS Confidentiality Act and the limits on AI in therapy (P. A.
104-0054, in force 1 August 2025), on top of HIPAA. Transportation: Secretary of State driver and vehicle records (625 ILCS 5/2-123) and licence plate reader data (2-130).
Public sector: the Freedom of Information Act, the Identity Protection Act, State agency information security and breach duties, and the Illinois rules on federal pass-through program data (public aid, unemployment insurance, and the LEADS criminal justice system). Biometric data is a separate framework, IL_BIPA.
Not yet in force, or regulations not published: the Department of Human Rights notice rules for AI in employment (reported proposed 15 May 2026 and withdrawn 10 June 2026), and the comprehensive consumer privacy bill SB 3548, which is not law. Not covered here: student data laws, and any Department of Financial and Professional Regulation cybersecurity rule (none was found).
Read from ilga. gov and the Illinois Administrative Code on 23 October 2026; the unverified items are listed in the file header.
General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Illinois state privacy and security law (sector tiers) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Privacy general | Applies to any organization that holds Illinois residents’ personal information: breach notice and Attorney General notice, reasonable security, contract terms, disposal, genetic information, and AI in employment decisions and video interviews. Choose this tier together with every sector tier that applies. | — |
| Insurance | Insurers, producers and insurance-support organizations: the Insurance Information and Privacy Protection Act (notice of practices, access within 30 business days, reasons for adverse decisions, disclosure limits, pretext interviews) and the Insurance Data Security Law (written security program, vendor oversight, notice to the Director within 3 business days). Licensees with fewer than 50 employees are exempt from the security program section (215 ILCS 215/35). | — |
| Finance | Illinois banks and the people who hold their customer records: s. 48.1 of the Illinois Banking Act limits disclosure of customer financial records, with a copy to the customer when records are demanded by legal process. No Illinois-specific cybersecurity rule from the Department of Financial and Professional Regulation was found; federal GLBA obligations are assessed in the GLBA framework. | — |
| Health | Health care organizations and their service providers in Illinois, on top of HIPAA: mental health and developmental disabilities records, HIV-related information, genetic information, notice to the Attorney General within 5 business days for HIPAA entities, and the limits on AI in therapy in force since 1 August 2025. | — |
| Transportation | Organizations that receive Secretary of State driver or vehicle records, operate licence plate readers, or monitor drivers: permitted purposes and no redisclosure for personally identifying information, and the limits on sharing licence plate reader information. Biometric driver monitoring is assessed in the IL_BIPA framework. | — |
| Public sector | State agencies, local governments, and the service providers that support them: the Freedom of Information Act, the Identity Protection Act for Social Security numbers, State agency information security and breach duties, and the Illinois rules on federal pass-through program data: public aid (Medicaid and benefits), unemployment insurance, and the LEADS criminal justice system. | — |
How Lavawall® helps you get to Illinois state privacy and security law (sector tiers) compliance
Most of Illinois state privacy and security law (sector tiers) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Illinois state privacy and security law (sector tiers), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Illinois state privacy and security law (sector tiers) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Illinois state privacy and security law (sector tiers) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Illinois state privacy and security law (sector tiers) Illinois law as read 23 Oct 2026
- Category
- Privacy
- Region
- USA - Illinois
- Levels
- 6 assessment tiers
All Illinois, United States frameworks and training →
Map this framework freeTalk to our team