Illinois does not have one main cybersecurity law. Instead, several Illinois regulatory mandates for cybersecurity compliance apply, and the ones that matter to you depend on the kind of data your business has and how you use it. News about “new bills” can also make it confusing to know what is actually law and what is just a proposal.
This confusion can be expensive. If you treat a proposal as if it is already law, you might waste time. If you miss a law that is already active, you could face lawsuits, fines, or even have an insurance claim denied.
This guide will help clear things up. You will learn which Illinois privacy laws are in effect now, which new bills are just proposals, which compliance deadlines are important, and get a checklist you can use this quarter.
What Are Illinois Cybersecurity Compliance Requirements?
If your business keeps personal information about Illinois residents, the Personal Information Protection Act (PIPA) says you must have reasonable security and quickly report any breaches. If you collect fingerprints or face scans, the Biometric Information Privacy Act (BIPA) requires you to get written consent. Since January 1, 2026, HB 3773 has required employers to tell employees and job applicants if they use AI in hiring or other job decisions.
Illinois Regulatory Mandates for Cybersecurity Compliance: What Applies Today
Today, three Illinois laws shape most cybersecurity requirements for businesses in the Chicago area. Before you look at them, try to sort each rule you come across into one of three groups:
- In force: it applies now.
- Proposed: it’s a bill, not yet law. No deadline is running.
- Conditional: it applies only if your industry, contracts, or insurer require it.
| Law | Citation | Who it applies to | Key requirements | Penalty or enforcer |
|---|---|---|---|---|
| Personal Information Protection Act (PIPA) | 815 ILCS 530/45 | Businesses holding Illinois residents’ personal information | Reasonable security measures | Attorney General, under the Consumer Fraud Act |
| PIPA breach notification | 815 ILCS 530/10 | Same | Notify residents without unreasonable delay | Attorney General |
| Biometric Information Privacy Act (BIPA) | 740 ILCS 14 | Businesses collecting biometric data | Written consent, retention policy | Private lawsuits: $1,000 to $5,000 per violation |
| HB 3773 | Illinois Human Rights Act | Illinois employers using AI in job decisions | Notice; no discriminatory AI | Illinois Department of Human Rights |
Personal Information Protection Act (PIPA, 815 ILCS 530)
PIPA is the foundation. It covers any data collector that manages personal information of Illinois residents, even if your business is located in another state.
Personal information means things like Social Security numbers, driver’s license numbers, account or card numbers with access codes, medical and health insurance details, biometric data, and usernames or emails with passwords. Nearly every employer keeps some of this in payroll or HR records.
Section 45 says you must “implement and maintain reasonable security measures.” The law does not list exact requirements. What counts as reasonable depends on the type of data you have. For example, a company storing client tax returns needs stronger protections than a store with just a mailing list.
PIPA also says you must securely dispose of records (Sec. 40). If you share this data with a vendor, your contract must require the vendor to protect it as well (Sec. 45(b)). If you already follow a stricter state or federal law, or the GLBA safeguards rule, that counts as compliance (Sec. 45(c) and (d)).
Illinois Data Breach Notification Law: The Real Timeline
The Illinois data breach notification law requires notice to affected residents “in the most expedient time possible and without unreasonable delay” (815 ILCS 530/10). You may first take steps to determine the scope of the breach and restore your systems.
If 500 or more Illinois residents are affected, you must also notify the Illinois Attorney General, no later than you notify residents. That notice describes the breach, the number of residents affected, and the steps you’ve taken. The AG accepts reports through its Data Breach Notice System.
You must provide the notice to residents at no cost, and it should include the following information:
- Contact details for the consumer reporting agencies and the FTC
- Information on fraud alerts and security freezes
It must not say how many Illinois residents were affected.
Is there a 45-day deadline? No. Some online sources claim Illinois gives businesses 45 days to report a breach, but the law does not set a 45-day limit. The rule is “without unreasonable delay,” which could be much sooner. There is one related deadline: if you are a HIPAA-covered entity and report a breach to the federal government, you must notify the Illinois Attorney General within five business days of that report (815 ILCS 530/50).
Biometric Information Privacy Act (BIPA, 740 ILCS 14)
BIPA covers fingerprints, face scans, hand geometry, and retina or iris scans. Before collecting any, you need written consent. You also need a public policy on how long you keep the data and when you destroy it. You cannot sell or profit from it.
BIPA is the riskiest Illinois privacy law for small businesses because individuals can sue directly. Damages reach $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney fees.
SB 2979, signed August 2, 2024, eased this. Repeated scans of the same person by the same method now count as one violation, and electronic signatures count as written consent (Byte Back). In 2026, the Seventh Circuit held that the change also applies to cases already pending (JD Supra).
Common small-business triggers include fingerprint time clocks, face- or fingerprint-based door access, and biometric sign-in to company systems. If you use any of these, read about building access systems as a security risk.
HB 3773: AI in Hiring and Employment Decisions
HB 3773 amended the Illinois Human Rights Act and took effect January 1, 2026 (Morgan Lewis). If you use AI in recruiting, hiring, promotion, discipline, firing, or other job decisions, you must tell employees and applicants.
You also can’t use AI that discriminates against protected classes, and you can’t use zip codes as a stand-in for them. The Illinois Department of Human Rights may issue rules on how and when notice is given.
Many HR and applicant-screening tools now include AI features, often switched on by default. Check yours, and see how employees using AI tools at work can expose company data.
Other Illinois Laws Worth Knowing
- Computer Crime Prevention Law (720 ILCS 5/16D): makes unauthorized computer access and tampering a crime. It helps if you’re the victim.
- Electronic Commerce Security Act (5 ILCS 175): gives electronic records and signatures legal effect and sets rules for secure electronic signatures.
New Bills and Compliance Deadlines: Illinois Cybersecurity Dates to Watch
Below are the new bills and compliance deadlines for Illinois cybersecurity that are currently important. Most deadlines for Chicago-area businesses have already passed, so those rules now apply.
Illinois state government regulatory mandates and compliance deadlines, by date
| Date | Law or bill | What it requires | Who it affects | Status |
|---|---|---|---|---|
| Jan 1, 2027 | SB 315, AI safety law for frontier models | Safety frameworks, transparency reports, incident reporting; audits begin 2028 | Only developers of very large “frontier” AI models, not small businesses | Signed July 6, 2026 (Global Policy Watch) |
| Jan 1, 2026 | HB 3773 (Illinois Human Rights Act) | Notice when AI is used in job decisions; no discriminatory AI; no zip code proxy | Illinois employers | In force |
| Aug 2, 2024 | SB 2979 (BIPA amendment) | One violation per person per method; e-signatures count as consent | Any business collecting biometrics | In force |
| Jan 1, 2017 | PIPA Sec. 45 (P.A. 99-503) | Reasonable security; vendor contracts must require the same | Businesses with Illinois residents’ data | In force |
| Per breach | PIPA Sec. 10 breach notice | Residents: “most expedient time possible and without unreasonable delay.” AG: if 500+ residents, no later than resident notice | Businesses with Illinois residents’ data | In force |
| None running | HB3576, water utility cybersecurity | Cybersecurity program, incident reporting, cyber insurance, framework alignment | Water utilities only | Pending (last action Mar 21, 2025: re-referred to Rules Committee) |
Status checked October 15, 2026. Bills change, so check the Illinois General Assembly site before acting.
Not sure which of these apply to you? Get a Free Security Assessment, and we’ll show you where you stand.
How to Tell a Bill From a Law
A bill is just a proposal. Deadlines only begin once a law is officially enacted and has an effective date. Use this five-step checklist whenever you hear about a ‘new Illinois cybersecurity law’:
- Open the bill’s page on the Illinois General Assembly site.
- Confirm it became a Public Act.
- Read the enacted text, not a summary or the original bill.
- Find the effective date and exactly who is covered.
- Count any deadline only from that effective date.
For example, HB3576 would require water utilities to create a cybersecurity program within 120 days. However, since it is still in the Rules Committee, the deadline has not started, and the bill only applies to water utilities. Check for updates like this every few months so you are not caught off guard by new laws.
Which Illinois Cybersecurity Laws Apply to Your Business?
PIPA applies to almost every business on this list. BIPA and HB 3773 depend on what you do, and federal rules depend on your industry. Find your row:
| Industry | PIPA | BIPA | HB 3773 | Federal or industry rules |
|---|---|---|---|---|
| Professional services | Yes | If you use biometrics | If you use AI in hiring | FTC Safeguards Rule (tax preparers) |
| Financial services | Yes | If you use biometrics | If you use AI in hiring | GLBA, FTC Safeguards Rule, FINRA |
| Manufacturing | Yes | If you use biometrics | If you use AI in hiring | CMMC (defense suppliers) |
| Education | Yes | If you use biometrics | If you use AI in hiring | FERPA |
| Nonprofit | Yes | If you use biometrics | If you use AI in hiring | PCI DSS (card donations) |
| Healthcare | Yes | If you use biometrics | If you use AI in hiring | HIPAA |
For example, a 40-person accounting firm in Schaumburg stores client tax data, so PIPA applies. If it uses fingerprint time clocks, BIPA applies. If its HR software ranks job applicants, HB 3773 applies. Each law requires its own review, not just one general Illinois deadline.
What Ignoring Illinois Cybersecurity Mandates Costs
Not following compliance rules usually costs more in the long run. It’s rarely just a single fine. You might also face lawsuits, investigations, or have insurance claims denied.
- PIPA: a violation is an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 530/20). The Attorney General can investigate and bring enforcement action.
- BIPA: damages are counted per person. Even after the 2024 amendment, 100 employees on a fingerprint time clock without consent could mean $100,000 or more in negligent damages, plus attorney fees.
- Cyber insurance: insurers now ask for proof of MFA, backups, and an incident response plan at renewal. A claim denied because a control was missing can cost far more than the control. See the cyber insurance requirements in 2026.
When planning your cybersecurity budget for Illinois rules, compare the costs to these risks, not to spending nothing.
Illinois Cybersecurity Compliance Checklist
Follow these 10 steps in order. Each step matches one of the laws mentioned earlier.
- Inventory your data. List where you store personal, financial, health, and biometric data.
- Map the laws. Use the industry matrix above to see which laws apply.
- Turn on MFA for email, remote access, and every admin account.
- Encrypt sensitive data on laptops, servers, and in the cloud.
- Back up offline and test restores on a schedule.
- Write an incident response plan with named owners and breach notice steps.
- Adopt a BIPA consent and retention policy before collecting any biometrics.
- Update vendor contracts so vendors must keep reasonable security.
- Train staff every year on phishing and safe data handling.
- Name one owner to check for new Illinois laws every quarter.
Using continuous monitoring and endpoint protection can help show you have “reasonable security” if anyone asks.
Not ready to talk? Take the free 5-minute IT Health Assessment.
Federal and Industry Rules That Stack on Top
Illinois law is only one layer. Depending on your industry, HIPAA, PCI DSS, CMMC, the FTC Safeguards Rule, and the Gramm-Leach-Bliley Act (GLBA) may also apply. They don’t replace Illinois law; they add to it. The NIST Cybersecurity Framework is voluntary, not an Illinois law, but it’s a practical way to show reasonable security. For more, read about HIPAA, PCI DSS, and CMMC requirements.
How BSGtech Helps Chicago-Area Businesses Meet Illinois Requirements
BSGtech provides cybersecurity services in Illinois that turn these laws into working controls. We help you:
- Assess your cyber risk and find the gaps.
- Support compliance and governance work.
- Implement security controls, such as MFA, encryption, and endpoint protection.
- Monitor your systems around the clock.
- Build an incident response plan with breach notice steps.
- Keep the documentation insurers and auditors ask for.
If you already have an internal IT person, co-managed IT adds security expertise without replacing them.
For small businesses in Illinois, cybersecurity starts with understanding your current situation. We work with clients in Schaumburg, Arlington Heights, Mount Prospect, Des Plaines, and nearby suburbs.
Frequently Asked Questions
What are Illinois cybersecurity compliance requirements?
Illinois cybersecurity compliance starts with PIPA, which requires reasonable security and breach notice for Illinois residents’ personal information. BIPA adds consent rules if you collect biometrics, and HB 3773 requires notice when you use AI in hiring or other job decisions. Other rules depend on your industry, such as HIPAA for healthcare.
Who enforces cybersecurity compliance in Illinois?
No single agency enforces it. The Illinois Attorney General enforces PIPA and receives breach reports. Under BIPA, individuals can sue businesses directly. The Illinois Department of Human Rights handles HB 3773 complaints about AI in employment. Federal agencies, such as the FTC, enforce federal rules in addition to state law.
What penalties exist for non-compliance with Illinois mandates?
Penalties depend on the law. The Attorney General enforces a PIPA violation as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. BIPA allows damages of up to $1,000 per negligent violation and $5,000 per intentional or reckless violation, per person, plus attorney fees.
Do all businesses face the same compliance standards in Illinois?
No. PIPA covers almost every business that holds Illinois residents’ personal information, but its “reasonable security” standard scales with the data you hold. BIPA applies only if you collect biometrics, and HB 3773 only if you use AI in job decisions. Federal rules depend on your industry.
Are third-party vendors required to comply with Illinois mandates?
Yes. Under PIPA Section 45(b), any contract that shares Illinois residents’ personal information with a vendor must require that vendor to keep reasonable security measures. Review your contracts with IT providers, payroll companies, cloud services, and anyone else who handles your data, and add security clauses where they’re missing.
Is Illinois cyber compliance stricter than federal guidelines?
On biometrics, yes. BIPA is one of the few US laws that lets individuals sue directly, which makes it far riskier than most federal privacy rules. On general security, Illinois sets a “reasonable” standard rather than a list of required controls, so frameworks such as NIST help define what reasonable means.
This article is general information, not legal advice. Speak to an attorney about your specific situation.
