Louisiana Enacts New Law Regulating Consumer Data Privacy

On May 29, 2026, Governor Jeff Landry signed the Louisiana Data Privacy Act (LDPA) into law. Louisiana now joins 21 other states who have adopted similar consumer data privacy laws. The new law, which takes effect on January 1, 2027, provides a comprehensive regulatory framework for consumer data privacy. The LDPA provides additional protections for consumer data privacy. It also sets new responsibilities for certain businesses.

Businesses Covered by the LDPA

The LDPA applies to select persons or entities in Louisiana that meet one or more of the following standards: (1) annual gross revenues exceeding $25 million; (2) annually buys, receives for the business’s commercial purposes, sells or shares for commercial purposes the personal information of at least 75,000 consumers, households or devices; or (3) derives 50% or more of its annual revenues from selling customers’ personal information.

However, there are many entities and data categories exempted by the LDPA. It does not apply to state agencies or political subdivisions, financial institutions, affiliates or data subject to the Gramm-Leach-Bliley Act, non-profit organizations, higher education institutions and health records, among others.

New Consumer Rights and Business Responsibilities

Consumers will now have the right to request whether a business is processing his or her personal data, request the data be deleted, access the data and the choice to opt out of the processing of personal data for targeted advertising. The business is required to respond to the data request within 45 days of receipt. The business may extend the response deadline by another 45 days if the data requests are complex or numerous and if the consumer is notified of the delay and the reason for it.

Businesses are now required to limit the collection of personal data to what is “adequate, relevant and reasonably necessary” in relation to the purposes for which the personal data is processed, as disclosed to the consumer. Businesses are also required to establish, implement and maintain “reasonable administrative, technical and physical data security practices” that are appropriate to the volume and nature of the personal data at issue.

Enforcement of the LDPA

The Attorney General of Louisiana is tasked with enforcement of the LDPA. Of note, any violation of the LDPA is termed “an unfair and deceptive trade practice” as defined by Louisiana Revised Statute 51:1404 (“LUTPA”). Importantly, this distinction permits the state to recover treble damages and attorney’s fees under LUTPA when a violation is knowingly engaged in. Until July 31, 2027, the Attorney General is required to notify a person in writing 30 days before an investigation commences, of the specific provisions of the LDPA the attorney general alleges have been violated. A subsequent investigation is barred if the person cures the alleged violation within 30 days.