Governance, risk & compliance

Louisiana Data Privacy Act (LDPA) La. R.S. 51:1780.1 to 1780.5 (Act 502 of 2026, SB 386); effective 1 Jan 2027 (not yet in force)

The Louisiana Data Privacy Act is La.

R. S.

51:1780. 1 to 1780.

5, enacted by Act 502 of the 2026 Regular Session (SB 386, signed 29 May 2026) with an effective date of 1 January 2027, so it is not yet in force. It applies to businesses in Louisiana that have annual gross revenues over $25 million, or handle the personal information of 75,000 or more consumers, households or devices, or earn 50% or more of revenue from selling personal information.

Any one test is enough. Government, financial institutions, HIPAA entities, nonprofits, higher education and electric utilities are exempt.

Consumers can confirm and access, correct, delete and copy their data and opt out of targeted advertising, sale and profiling. Responses are due in 45 days (extendable by 45), appeals in 60 days, and controllers must offer two or more request methods.

Sensitive data needs consent, with COPPA for known children, and a controller that sells sensitive or biometric data must post a specific notice. Assessments are required for processing as of 1 January 2027.

There is no universal opt-out mandate in the text read. The Attorney General enforces under the Unfair Trade Practices and Consumer Protection Law, without private rights of action.

A 30-day cure runs only from 1 January to 31 July 2027. Read from the enrolled Act.

Penalty amounts in the trade practices law were not read. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Louisiana Data Privacy Act (LDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Louisiana Data Privacy Act (LDPA) compliance

Most of Louisiana Data Privacy Act (LDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Louisiana Data Privacy Act (LDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Louisiana Data Privacy Act (LDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Louisiana Data Privacy Act (LDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.