Louisiana Data Privacy Act: Requirements and Compliance Guide

Louisiana businesses have a new privacy deadline: January 1, 2027. That’s when the Louisiana Data Privacy Act (LDPA) takes effect, giving eligible consumers new rights over their personal information and requiring covered organizations to strengthen how they collect, use, protect, and manage that data.

Louisiana enacted the law through Senate Bill 386, Act No. 502 of 2026, which Governor Jeff Landry signed on May 29, 2026.

For privacy, security, and compliance leaders, the challenge goes beyond updating a privacy notice. Organizations need to know where personal information lives, which systems process sensitive data, how they respond to consumer requests, and whether high-risk processing activities require documented assessments.

That makes data discovery and classification, privacy automation, and data governance central to an effective compliance program.

This guide explains who the Louisiana Data Privacy Act covers, what it requires, the deadlines that matter, and how BigID helps organizations turn privacy obligations into repeatable operational workflows.

What Is the Louisiana Data Privacy Act?

The Louisiana Data Privacy Act is a comprehensive state consumer privacy law that regulates how qualifying businesses process personal data belonging to Louisiana residents.

The law appears in Louisiana Revised Statutes Title 51, Sections 1780.1 through 1780.5. It creates obligations for controllers, which determine why and how organizations process personal data, and processors, which handle personal data on a controller’s behalf.

The LDPA grants consumers rights to access, correct, delete, and obtain certain personal data, as well as opt out of specified processing activities. It also requires covered controllers to limit unnecessary data collection, protect personal information, obtain consent for sensitive data processing, and assess certain higher-risk activities.

The central compliance question is straightforward: Can your organization locate, understand, and act on the personal information it manages?

Without reliable data visibility, even well-written privacy policies become difficult to implement consistently.

When Does the Louisiana Data Privacy Act Take Effect?

The Louisiana Data Privacy Act takes effect on January 1, 2027.

The law also establishes a temporary enforcement cure process from January 1 through July 31, 2027. During that period, qualifying remediation can prevent the attorney general from initiating an investigation into a specifically identified violation, provided the organization meets all statutory conditions.

Organizations should not treat this temporary process as an extension of the effective date.

Who Must Comply With the Louisiana Data Privacy Act?

The LDPA applies to a person or entity that does business in Louisiana and meets at least one of three statutory thresholds.

The law includes entity-level exemptions for certain government bodies, financial institutions and affiliates or data subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities and business associates, nonprofit organizations, higher education institutions, certain utilities, and specified polling organizations.

It also exempts certain categories of information, including qualifying health, credit reporting, education, and employment-context data.

Because the exemptions vary by entity and information type, organizations should evaluate their processing activities rather than assume that every dataset receives the same treatment.

How BigID helps: Data discovery and classification can help teams identify relevant personal information across supported environments. Legal and compliance teams can then assess statutory coverage, exemptions, and obligations using that data context.

What Consumer Rights Does the Louisiana Data Privacy Act Establish?

Under R.S. 51:1780.3, Louisiana consumers have rights to:

• Access: Confirm whether a controller processes their personal data and access that information.
• Correction: Correct inaccuracies in personal data, taking account of its nature and processing purpose.
• Deletion: Request deletion of personal data they provided or that the controller obtained about them, subject to statutory exceptions.
• Portability: Obtain qualifying data they previously provided in a portable digital format, where technically feasible.
• Opt-out: Opt out of targeted advertising, the sale of personal data, and certain profiling that supports legally or similarly significant decisions.

Consumers must submit authenticated requests. Parents or legal guardians may exercise rights on behalf of known children.

How Long Do Businesses Have to Respond?

Controllers generally must respond to consumer requests within 45 calendar days. They may extend that period once by an additional 45 days when reasonably necessary, provided they notify the consumer within the initial period and explain the extension.

If a controller refuses a request, it must explain the decision and provide appeal instructions. The law requires a written appeal decision within 60 calendar days.

Controllers must also establish applicable secure request-submission methods, subject to the law’s specific exceptions and qualifications.

What Counts as Sensitive Data Under the LDPA?

Louisiana defines sensitive data to include personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, certain genetic and biometric data, personal data collected from a known child, and precise geolocation data.

Controllers generally must obtain consumer consent before processing sensitive data. For known children, the statute refers to applicable Children’s Online Privacy Protection Act requirements and exceptions.

The law defines consent as a clear affirmative act. Broad terms of service, certain passive interactions, and dark patterns do not establish valid consent under the statutory definition.

Businesses that sell sensitive personal data or biometric personal data must also evaluate the law’s specific privacy notice requirements.

How BigID helps: BigID’s sensitive data discovery and classification helps organizations find categories of sensitive information across enterprise systems. Teams can use those findings to review processing purposes, consent requirements, and access controls.

What Other Requirements Does the Louisiana Data Privacy Act Impose?

Data Minimization and Purpose Limitation

Controllers must limit personal data collection to information that is adequate, relevant, and reasonably necessary for disclosed processing purposes.

They generally cannot process personal data for incompatible purposes without obtaining consent, subject to statutory exceptions.

Organizations should review what they collect, why they collect it, and whether they continue retaining information after its business purpose ends.

Reasonable Data Security

Controllers must maintain reasonable administrative, technical, and physical security practices appropriate to the volume and nature of the personal data involved.

Security teams need accurate information about sensitive data locations, access permissions, and exposure to prioritize safeguards.

Transparent Privacy Notices

Controllers must provide a reasonably accessible, clear privacy notice describing relevant categories of personal data, processing purposes, consumer rights procedures, appeal procedures, and applicable data sales disclosures.

The statute also specifies additional notices for businesses that sell sensitive or biometric personal data.

Processor Contracts and Oversight

Controllers and processors must use contracts that define processing instructions, purpose, data types, duration, and the parties’ responsibilities.

The statute also addresses confidentiality, deletion or return of data, assessment cooperation, and subcontractor obligations.

Data Protection Assessments

Controllers must conduct and document data protection assessments for certain processing activities, including:

• Targeted advertising.
• Sale of personal data.
• Processing sensitive data.
• Profiling that presents specified foreseeable risks.
• Other personal data processing that presents heightened risk of harm to consumers.

Assessments must weigh processing benefits against consumer risks and consider available safeguards and the processing context.

The statute requires assessments for processing activities beginning January 1, 2027, and does not apply that requirement retroactively.

How BigID Helps Organizations Comply With the Louisiana Data Privacy Act

Effective LDPA compliance depends on more than knowing the law. Organizations must translate legal requirements into repeatable data and privacy operations.

BigID helps teams connect the dots between personal data, consumer rights, privacy risk, and remediation.

Its data intelligence and privacy capabilities can help organizations reduce manual discovery work, coordinate responses, and prioritize privacy obligations across supported enterprise environments.

1. Discover and Classify Personal and Sensitive Data

Organizations cannot reliably govern information they cannot locate.

BigID helps discover and classify personal and sensitive data across supported enterprise data sources, providing context for privacy assessments, rights requests, and security priorities.

Compliance value: Identify relevant information faster and reduce reliance on disconnected inventories and manual searches.

2. Operationalize Consumer Data Rights

Louisiana gives eligible consumers rights to access, correct, delete, and obtain certain personal data, alongside specified opt-out rights.

BigID privacy automation supports data rights workflows by connecting request management with enterprise data discovery and operational processes.

Compliance value: Help privacy teams coordinate requests more efficiently and support timely, documented responses.

3. Support Data Protection Assessments

LDPA assessments require meaningful context about personal data, processing activities, risks, and safeguards.

BigID’s data intelligence and privacy governance capabilities help teams identify relevant sensitive data and support assessment workflows.

Compliance value: Give privacy teams stronger data context when they document high-risk processing and remediation decisions.

4. Reduce Unnecessary Data Retention and Exposure

Data minimization and security obligations create an ongoing need to review unnecessary information and risky data access.

BigID’s data retention, discovery, and security-related capabilities help organizations identify information that may require lifecycle review and assess sensitive data exposure.

Compliance value: Prioritize unnecessary data, improve governance consistency, and support risk reduction.

5. Connect Privacy Compliance Across Regulations

Many organizations must comply with several state privacy laws rather than Louisiana’s requirements alone.

BigID helps centralize data intelligence and privacy operations that teams can reuse across applicable regulatory programs, including consumer rights, sensitive data identification, and privacy assessments.

Compliance value: Build reusable workflows instead of treating every new privacy law as a separate manual project.

How Can Organizations Prepare for Louisiana’s 2027 Privacy Deadline?

A practical LDPA readiness program should prioritize data visibility first, then connect that foundation to privacy rights, sensitive data processing, assessments, and security controls.

Who Enforces the Louisiana Data Privacy Act?

The Louisiana Attorney General enforces the LDPA.

The statute treats violations as unfair or deceptive trade practices under Louisiana’s consumer protection framework, while excluding the private rights of action that framework otherwise provides under specified provisions.

From January 1 through July 31, 2027, the law establishes a temporary notice-and-cure process. To benefit from it, an organization must correct the alleged violation within the statutory period, provide a written statement, submit supporting documentation, and make necessary policy changes to prevent recurrence.

Organizations should not assume that a right to cure will remain available after July 31, 2027.

Reliable privacy operations can help organizations identify issues earlier, document corrective action, and support responses to regulatory inquiries.

Louisiana Data Privacy Act: Frequently Asked Questions

When does the Louisiana Data Privacy Act take effect?

The Louisiana Data Privacy Act takes effect January 1, 2027. Louisiana enacted it through SB 386, Act No. 502 of 2026.

Which businesses must comply with the LDPA?

The law applies to entities doing business in Louisiana that meet at least one statutory threshold involving annual gross revenue, commercial processing of personal information relating to 75,000 or more consumers, households, or devices, or revenue derived from selling consumers’ personal information. Exemptions may apply.

What rights do Louisiana consumers have?

Eligible consumers can request access, correction, deletion, and portability of qualifying personal data. They can also opt out of targeted advertising, personal data sales, and certain profiling.

How long do businesses have to respond to privacy requests?

Controllers generally have 45 calendar days to respond, with one possible 45-day extension when statutory conditions apply. The law also establishes an appeals process.

Does the Louisiana Data Privacy Act require consent for sensitive data?

Yes. Controllers generally must obtain consent before processing sensitive personal data. Special rules apply to known children under the Children’s Online Privacy Protection Act framework.

Does the LDPA require data protection assessments?

Yes. Controllers must assess specified activities such as targeted advertising, personal data sales, sensitive data processing, certain high-risk profiling, and other heightened-risk processing. The assessment requirement applies to processing activities beginning January 1, 2027.

Does Louisiana provide a private right of action under the LDPA?

No. The Louisiana Attorney General enforces the Act, and the statute excludes specified private rights of action under Louisiana’s unfair trade practices framework.

How can BigID help with Louisiana Data Privacy Act compliance?

BigID helps organizations operationalize key privacy requirements through personal and sensitive data discovery, data classification, privacy and consumer rights workflows, data protection assessment support, retention governance, and risk context. These capabilities help privacy teams coordinate compliance work more efficiently. Organizations remain responsible for legal determinations, consent implementation, and appropriate security controls.

Official Sources and Further Reading

• Louisiana Legislature: SB 386, Enrolled Act No. 502 of 2026
• Louisiana Legislature: SB 386 Legislative History
• BigID Data Discovery and Classification
• BigID Privacy Automation
• BigID Data Retention

This article provides general educational information and does not constitute legal advice. Organizations should consult qualified legal counsel when evaluating the Louisiana Data Privacy Act and their compliance obligations.

Author

Lonnie Ross

Digital Experience Marketing Lead

Lonnie is the Digital Experience Marketing Lead at BigID, bringing over a decade of SEO and digital marketing expertise across B2C and B2B businesses in SaaS and eCommerce. Having worked both in tech and on the agency side, Lonnie combines a strong foundation in search strategy, UX, and content development with a passion for the evolving landscape of data protection. From aligning content with search intent to sharpening brand voice, Lonnie ensures that organizations not only stand out in a competitive SaaS market but also build trust through thought leadership on critical issues like compliance, data risk, and responsible innovation.