Louisiana SaaS Agreement Review
Louisiana's comprehensive privacy law, the Louisiana Data Privacy Act (SB 386, signed May 29, 2026), does not take effect until January 1, 2027, and its Database Security Breach Notification Law, La. R.S. 51:3071 and following, is more detailed than many. Amended in 2018, it sets a 60 day outer limit, requires a written report to the Attorney General, and gives residents a private right of action for actual damages. A New Orleans or Baton Rouge business buying software should line its vendor terms up with those deadlines.
Consumer privacy law in Louisiana
Louisiana Data Privacy Act (SB 386), effective January 1, 2027Takes effect January 1, 2027
Not in force until January 1, 2027. Will apply to businesses with over $25m in annual revenue, or handling personal information of 75,000 or more consumers, households or devices, or earning 50% or more of revenue from selling personal information.
Data rights in Louisiana
Louisiana has enacted the Louisiana Data Privacy Act (SB 386), effective January 1, 2027, a comprehensive consumer privacy law that takes effect on January 1, 2027. Until then residents have no comprehensive statutory data rights, and the SaaS contract is your main protection. For a contract that runs past that date, ask the vendor to commit to a data-processing agreement that meets the new law.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What are Louisiana's breach deadlines?
Residents must be notified in the most expedient time possible and no later than 60 days after discovery. An extension is allowed to determine scope or restore systems, but the business must give the Attorney General written reasons within the 60 days. The Attorney General's Consumer Protection Section must receive written notice, including the names of affected Louisiana citizens, within 10 days of the resident notices. Each day of delay is a separate violation.
Records, penalties and the vendor contract
If a business decides there is no reasonable likelihood of harm and skips notice, it must keep that written determination for five years and produce it on request. Late notice can draw fines of up to $5,000 per violation. Since a SaaS vendor often controls the forensic evidence, the contract should require it to share findings and retain logs long enough to support your decisions.
Louisiana's definition also covers biometric data and passport numbers, which many vendor security exhibits leave out.
Louisiana exemptions and substitute notice
Substitute notice by email, website and statewide media is allowed if direct notice would cost more than $100,000 or reach more than 100,000 people. Financial institutions that comply with the 2005 federal interagency guidance on breach response are treated as compliant. A business following its own procedures with consistent timing is also deemed compliant.
Louisiana sources checked 2026-10-09: Ashurst Perkins Coie, Louisiana breach chart. Laws change; confirm the current rule before relying on it.
Louisiana SaaS agreement FAQ
Does Louisiana have a data privacy law that affects SaaS contracts?
Not yet in force. Louisiana has enacted the Louisiana Data Privacy Act (SB 386), effective January 1, 2027, but it takes effect on January 1, 2027. Until then there is no comprehensive state privacy law, so the SaaS contract itself is your main protection; for a multi-year contract, make sure the vendor will meet the new law when it starts.
Can a SaaS vendor use my Louisiana business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Louisiana law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Louisiana?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Louisiana law in about a minute.
Can Louisiana residents sue over a SaaS breach?
Yes. The statute allows a civil action to recover actual damages resulting from a failure to give timely notice. That makes notification speed a real liability issue, so negotiate a vendor reporting window short enough to meet the 60 day limit and an indemnity for claims caused by the vendor's delay.
Does Louisiana require a security program for businesses using SaaS?
Louisiana law requires businesses that own or license personal information of residents to maintain reasonable security procedures and to take reasonable steps to destroy records containing it when no longer needed. Make the vendor contractually responsible for equivalent safeguards and for documented deletion when the subscription ends.
Reviewing a SaaS contract in Louisiana?
Upload it and get the data, liability, and renewal terms checked against Louisiana law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Louisiana law when you run your agreement, and you should confirm anything critical with a qualified attorney.