Since 2024, every licensee of the Illinois Department of Insurance falls under the Insurance Data Security Law. We tell you exactly which parts apply to your agency, then put in place the program, the safeguards, and the incident plan the law expects, at a fixed price.
The law (215 ILCS 215, Public Act 103-0142) took effect on January 1, 2024 and applies to licensees of the Illinois Department of Insurance, including agencies and producers.
Based on a risk assessment, with safeguards such as access controls, encryption, staff training, and an incident response plan. Required since January 1, 2025, and oversight of your third-party service providers since January 1, 2026.
215 ILCS 215/10When an event may have occurred, you must promptly investigate it: what happened, which information was involved, and what was done to restore security.
215 ILCS 215/15If the event involves nonpublic information of 250 or more Illinois consumers, or Illinois is your home state and harm is reasonably likely, you must notify the Director of Insurance no later than 3 business days after determining it occurred.
215 ILCS 215/20Agencies with fewer than 50 employees, including independent contractors, are exempt from the written program requirement (Section 10). They are not exempt from investigating cybersecurity events or from the 3-business-day notice to the Department of Insurance. We tell you exactly which case applies to your agency.
We confirm your headcount, your systems, and which parts of the law apply to your agency.
We review your AMS, email, accounts, and vendors, remotely or on site, around your busy renewal periods.
We write your incident response plan and, if you have 50 or more employees, your full information security program.
We present the results and fixes to you, and help you keep the program current every year.
Starting prices for a typical small office. Your written quote sets the final price after the free call.
The law applies to licensees of the Illinois Department of Insurance, which includes insurance agencies and producers. What changes from one agency to another is which sections apply, mainly based on your number of employees.
Partly. Agencies with fewer than 50 employees, including independent contractors, are exempt from the written information security program (Section 10). You must still investigate any cybersecurity event and notify the Department of Insurance within 3 business days when the notification conditions are met.
No later than 3 business days after determining that a cybersecurity event occurred, if the nonpublic information of 250 or more Illinois consumers is involved, or if Illinois is your home state and the event is reasonably likely to cause material harm. The Department asks that notices be sent to DOI.DataSecurity@illinois.gov.
Your vendor secures its platform, but the law makes licensees with a written program responsible for overseeing their third-party service providers, a requirement in effect since January 1, 2026. Weak passwords, shared logins, or no multi-factor authentication on your side remain your responsibility.
An employee, agent, or representative of a licensee who is covered by that licensee's information security program does not need a separate program. Independent agencies need to look at their own situation.
Most often a hacked email account used to send fake payment or policy change requests, ransomware on the office network, or a lost laptop holding client files. Our incident response plan tells your team exactly what to do in each case.
This page is general information about regulatory requirements, not legal advice.