The states that have adopted the NAIC Insurance Data Security Model Law are, according to the NAIC's own state page for the model (Summer 2026): Alabama, Alaska, Connecticut, Delaware, Hawaii, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Missouri, New Hampshire, North Dakota, Ohio, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Tennessee (portions of the model), Vermont, Virginia and Wisconsin, together with Puerto Rico. That is 28 jurisdictions, 27 states and one territory. New York is not on the list: it applies its own cybersecurity regulation, 23 NYCRR Part 500, which the model's drafters had in view. California, Texas, Florida, Massachusetts and Washington appear only as related activity, governed by other insurance rules and their breach laws. And the adopters did not all keep the model's 72 hours.
For an insurer licensed in many states, the list decides which commissioners must hear of a cybersecurity event and how fast, and it keeps changing: two states joined in 2026. That is part of the work Botminds' Data Breach Notification Management takes on. Counsel keeps one rule per state, model or not; the solution's AI agents apply each to an incident and draft each commissioner notice, and people sign. Its fictional sample incident, a vendor ransomware attack at Wrenfield Mutual, applied nine insurance data security laws at once.
The NAIC model's reach in autumn 2026
28of 56
NAIC member jurisdictions in the Model Adoption column
2
adopted in 2026: Alaska and Missouri
1
adopted “portions of model”: Tennessee
0
of New York, California, Texas and Florida on the adoption list
Which states have adopted the NAIC insurance data security model law, and when?
Twenty-eight jurisdictions have, by the NAIC's count, beginning in 2018. The table lists them by the earliest year the NAIC cites for each state's enactment. Several states have since amended their laws, and the NAIC shows those later years too; the first year dates the original enactment.
The 28 adopting jurisdictions, by the first year the NAIC cites
| Year | Jurisdictions |
|---|---|
| 2018 | Michigan, Ohio, South Carolina |
| 2019 | Alabama, Delaware, Mississippi, New Hampshire |
| 2020 | Connecticut, Indiana, Louisiana, Virginia |
| 2021 | Hawaii, Iowa, Maine, Minnesota, North Dakota, Tennessee (portions of the model), Wisconsin |
| 2022 | Kentucky, Maryland |
| 2023 | Pennsylvania, Vermont |
| 2024 | Illinois, Oklahoma, Rhode Island |
| 2025 | Puerto Rico |
| 2026 | Alaska, Missouri |
How many states have adopted the model, and what does "adopted" mean?
Twenty-seven states and Puerto Rico have adopted it, 28 of the NAIC's 56 member jurisdictions, and "adopted" is the NAIC Legal Division's judgement of how close a state's law is to the model. The state page's key puts a state in the Model Adoption column when it adopted the current model in substance, in its entirety but with room for differences of style and format, and includes a state that adopted portions with a note (NAIC state page; the key is read word by word in how states adopt NAIC model laws). That is how Tennessee, with "portions of model", is in the 28.
The NAIC is careful to say what the list is not. The page says it is not a formal legal opinion on state law, and the adoption map adds that it makes no judgement on whether an enacted law contains every element of the model (NAIC adoption map; both caveats are explained in NAIC model law state adoption charts). For a compliance team the list is the starting point for finding each statute, not a substitute for reading it.
The NAIC's 56 member jurisdictions, by column on the model's state page
56 member jurisdictions
- Model adopted 28 · 50%
- Related activity only 25 · 44.6%
- Marked no current activity 3 · 5.4%
Adoption by year: a model that is still spreading
Adoption came in a wave and has not stopped. Seven states enacted the model in 2021 alone, the busiest year; since then one to three a year have followed, and Alaska and Missouri joined in 2026.
Adoptions of the NAIC Insurance Data Security Model Law, by first year cited
The model gave licensees one year from a state's effective date to implement the information security program and two years for the vendor oversight rules, but the notice duty in section 6 has no such delay. Where an enacted text follows the model's effective-date section, an insurer licensed in Missouri or Alaska owes those commissioners the notice from the day the law takes effect, whatever the state of its program.
The large states that have not adopted it
New York, California, Texas and Florida are not on the list, and neither are Massachusetts, Washington, New Jersey, North Carolina or Georgia. The NAIC files each under related activity: laws on the same subject that it does not count as adoption. For a multi-state insurer this means the model's 72 hours and 250-resident threshold cannot be assumed in several large states.
Each runs its own rule. New York requires notice to the superintendent within 72 hours of determining a cybersecurity incident at the company, an affiliate or a vendor, under 23 NYCRR 500.17, with no 250-resident threshold. Washington's insurance commissioner, under the commissioner's own rule, must be told the number of affected customers and the actions being taken "within two business days after determining notification must be sent to consumers or customers" under the state's breach law or HIPAA. California's related entries are Department of Insurance regulations from 2002 and its consumer privacy statute; Texas's is its 2024 data privacy and security statute, chapter 541 of the Business and Commerce Code; Florida's are its breach statute and its 2023 privacy law, sections 501.701 to 501.722. In those states the insurer's duties to residents and the attorney general come from the breach law, which is the subject of data breach notification laws by state.
Even the adopters changed the clock
Adoption "in a substantially similar manner" left room for states to change the deadline, and several did. A team that applies the model's 72 hours to every adopting state will be early in some and could be late in a state whose business-day rule it miscounts; the bigger risk is the reverse, a team used to business days applying them where the statute says hours.
The commissioner's clock in seven states, as each statute writes it
| State | Status | The clock | Counted from |
|---|---|---|---|
| South Carolina | Adopted, 2018 | “no later than seventy-two hours” | Determining that a cybersecurity event has occurred |
| Delaware | Adopted, 2019 | “in no event later than 3 business days” | The licensee’s determination; for a vendor’s event, “the first business day after” the vendor’s notice |
| Virginia | Adopted, 2020 | “in no event later than three business days” | The determination; 250 residents, or notice owed under federal or another state’s law |
| Iowa | Adopted, 2021 | “no later than three business days” | The date of the determination |
| Minnesota | Adopted, 2021 | “in no event later than five business days” | A determination; to the commissioner of commerce or of health |
| New York | Own regulation | “no event later than 72 hours” | Determining that a cybersecurity incident has occurred |
| Washington | Own rule | “within two business days” | Determining that consumers must be notified |
The table also shows differences beyond the number. Delaware starts a vendor's clock on the first business day after the vendor's notice, where the model says the day after. Virginia brings in its commissioner when 250 or more residents are involved or when notice is owed under federal law or another state's law, an "or" where the model has an "and". Minnesota routes the notice to whichever of two commissioners regulates the licensee. None of these is visible from an adoption list.
Insurance data security law states list: keeping it current
The NAIC publishes its state pages in dated editions, this one Summer 2026, and its adoption map carries its own status date: 8 October 2026 for this model's. Between editions, a state's law can be enacted, amended or take effect. Alaska's law and Missouri's both appear with 2026 dates on the Summer 2026 page; Rhode Island and Oklahoma show amendments as recent as 2025.
A list an insurer can rely on is one its counsel keeps, with each state's statute or regulation, its effective date, its clock, its threshold and the date counsel last checked it. In the sample incident that list held nine insurance data security laws, eight of which owed Wrenfield a notice; Delaware's did not, because only 174 of its residents were involved. The eight included New York's regulation and Washington's rule as well as model states.
Puerto Rico and the territories
Puerto Rico is the one territory in the 28, and it adopted by regulation rather than statute: the NAIC cites a 2025 rule, alongside an older circular letter of 2016 that it lists as related activity. The other territories are not adopters. Guam and the U.S. Virgin Islands appear under related activity, with laws from 2009 and from 2016 and 2024 respectively, and American Samoa and the Northern Mariana Islands are marked "no current activity".
The territories are easy to leave off a multi-state checklist because they are rarely on a state chart, and an insurer writing business there should check them explicitly. A Puerto Rico policyholder or claimant can bring in a notice to the territory's insurance regulator under that rule, which the NAIC counts as an adoption of the model.
Five things to check in each adopting state's statute
An adoption list tells a team where to look; the statute tells it what to do. Five points vary often enough between the enacted texts that each deserves a line in counsel's rules for every adopting state. First, the regulator's title and channel: the model's "Commissioner" becomes the director in South Carolina and one of two commissioners in Minnesota, and the notice usually goes "in electronic form as directed". Second, the unit of the clock: hours or business days. Third, the start rule for a vendor's event: the day after the vendor's notice in the model, South Carolina, Virginia and Minnesota, the first business day after it in Delaware.
Fourth, the threshold test: the model's 250 residents plus a reportability or harm test, or Virginia's 250 residents or a notice owed elsewhere. Fifth, the effective date and the date of the last amendment, because several adopters have amended since enactment and a rule written from the first version may be out of date. A sixth point, the list of items the notice must carry, is usually the model's thirteen, but it is worth confirming rather than assuming.
What applies in a state that has not adopted the model?
In a state without the model, an insurer looks for three things: an insurance-specific notice rule like Washington's, a breach law that names the insurance regulator as a recipient, and the breach law's duties to residents, the attorney general and the credit bureaus. New York's breach law, for example, requires notice to the Department of Financial Services for its licensees whenever any New York resident is notified, and routes that notice through Part 500. Where none of these exists, the insurer still owes the residents and the attorney general what the breach law requires, and the home state's commissioner what its own law requires.
That is why the adoption list and the breach-law chart have to be read together, and why the model's 250 threshold is not a safe proxy in a non-adopting state: Washington has no count threshold for its commissioner, and New York has none for its superintendent. How the two sets of law run at once is set out in the insurer's two clocks; the model's text, section by section, is in the Insurance Data Security Model Law explained.
How Data Breach Notification Management handles 28 versions
The solution does not apply "the model". It applies each state's text, kept by counsel as one row per law, with the clock, the threshold, the start rule for a vendor's event and the regulator's name, and it treats New York's regulation and Washington's rule as rows like any other.
One row per law: the commissioner column in the rules
When the incident's counts arrive, the rules agent applies each row and the notice drafter fills each commissioner notice with the items that state's text requires. Counsel signs each one. In the sample incident the eight notices were filed on 23 and 24 September, each with its receipt.
Questions people ask
Has New York adopted the NAIC insurance data security model law?
No. New York applies its own cybersecurity regulation, 23 NYCRR Part 500, which predates the model and which the model's drafters intended a compliant licensee to satisfy. It requires notice to the superintendent within 72 hours of determining a cybersecurity incident, with no 250-resident threshold.
Has California adopted the model law?
Not according to the NAIC's Summer 2026 state page, which lists California only under related activity: Department of Insurance regulations from 2002 and the state's consumer privacy law. California residents are notified under the state's breach statute, which since 1 January 2026 sets a 30-day deadline.
Has Texas adopted the NAIC insurance data security model law?
No. The NAIC lists Texas's 2024 data privacy and security act as related activity. A Texas insurer's breach duties come from the Business and Commerce Code: letters within 60 days of the determination and notice to the attorney general within 30 days if 250 or more Texans are affected.
Which states adopted the model in 2026?
Alaska and Missouri, both shown with 2026 citations on the NAIC's Summer 2026 state page. Puerto Rico's adoption, by regulation, is dated 2025.
Does adopting the model mean the state law is identical?
No. The NAIC counts a state as adopting when its law is substantially similar, allowing for variations in style and format. Delaware, Virginia and Iowa wrote three business days instead of 72 hours, and Minnesota five.