Wisconsin Insurance Data Security Law: Does It Apply to Your Agency?

If your insurance agency is licensed in Wisconsin, the state's insurance data security law already applies to you in some form. The real question is which parts.

Here is the short answer. Many smaller agencies are exempt from the biggest requirement, the written information security program. They are not exempt from investigating a cybersecurity event, reporting it to the Office of the Commissioner of Insurance (OCI) within three business days when the law's conditions are met, or notifying affected customers. And if the agency is licensed at the agency level and domiciled in Wisconsin, OCI still expects an annual certification by March 1, even when the agency is claiming an exemption.

This guide walks through the exemption tests, what stays with you either way, and what the program has to include once the exemption runs out. It is practical IT guidance, not legal advice. Your attorney and OCI are the final word on how the law applies to your agency.

Where this law comes from

The law is 2021 Wisconsin Act 73, which created subchapter IX of chapter 601 of the Wisconsin Statutes. OCI says it was based on the National Association of Insurance Commissioners model law.

It applies to "licensees": anyone licensed, authorized, or registered, or required to be, under chapters 600 to 655. That covers insurers, and it also covers agencies and individual producers.

The law is built in three parts:

• § 601.952: the written information security program
• § 601.953: investigating a cybersecurity event
• § 601.954: notifying OCI, consumers, and in some cases others

The exemption most small agencies rely on sits inside § 601.952. It does not reach the other two sections. That one detail changes how an agency should prepare.

The three exemption tests

Under § 601.952(9), the program requirement does not apply to a licensee that meets any one of these:

1. Less than $10,000,000 in year-end total assets
2. Less than $5,000,000 in gross annual revenue
3. Fewer than 50 employees, counting independent contractors who work at least 30 hours a week for the licensee

"Any one" matters. An agency with 55 people and $4 million in revenue still qualifies on revenue. An agency does not lose the exemption until it fails all three tests.

Two details are easy to miss:

• Contractors count toward the headcount. A contracted CSR or marketing person working 30 or more hours a week for you is part of the number.
• The clock starts when you stop qualifying. Under § 601.952(9)(b), a licensee that no longer qualifies has 180 days to comply. Growth through an acquisition, a producer team joining, or a strong renewal year can end the exemption without anyone announcing it.

A simple habit helps: check all three numbers each year before the March 1 certification, and write down the answer and the date you checked.

What stays with you even if you are exempt

This is the part owners tend to skip, and it is the part most likely to matter on a bad day.

You still have to investigate. If you learn that a cybersecurity event has or may have occurred, § 601.953 requires a prompt investigation. At minimum, that means working out what happened and how far it reached, identifying the nonpublic information involved, and taking reasonable steps to restore security. If the event happened at a vendor, you either investigate or make reasonable efforts to confirm and document what the vendor did.

You may have to notify OCI within three business days. For a Wisconsin-domiciled licensee, notice is required when the event has a reasonable likelihood of materially harming a consumer or a material part of the agency's normal operations. The statute counts the three business days from the determination that the event occurred. OCI's guidance is blunt about timing: do not wait for the investigation to finish. Report what you know, then send updates as you learn more.

You may have to notify customers. If nonpublic information was acquired by someone you did not authorize, § 601.954(2) requires reasonable efforts to notify each affected consumer within a reasonable time, not more than 45 days after you learn of it. There are exceptions, including when the acquisition creates no material risk of identity theft or fraud. If one incident requires notice to 1,000 or more consumers, the nationwide consumer reporting agencies must also be told. You also send OCI a copy of the form of notice you used.

You keep the records. Records about a cybersecurity event must be kept for at least five years.

You may still file a certification. OCI's certification FAQ says Wisconsin-domiciled intermediary firms that hold an agency-level license must submit the annual certification, and must do so even when they meet an exemption. The form has boxes for claiming it. Individual producers are not required to submit one.

Subchapter IX describes itself as the exclusive state standard for licensees on data security, event investigation, and notification. Wisconsin's general breach-notice law, § 134.98, is covered in our data breach response checklist; ask counsel how the two interact for your agency.

In practice, the three-business-day clock is the one to plan for. Three business days goes quickly when you are also trying to get email back and find out whether a client file was taken. An exempt agency that has never thought about who makes that call and what gets sent will spend those days scrambling.

What "nonpublic information" looks like in an agency office

The law protects electronic information that is not public and falls into one of two groups:

• Identifying information combined with a Social Security number, driver's license or state ID number, financial account or card number, a code or password that opens a financial account, or biometric records
• Health-related information from a consumer or health care provider that identifies the person and relates to their health, their care, or payment for that care

An agency handles plenty of both. Think about where it actually sits on a normal day:

• the agency management system
• email attachments: driver's license photos, loss runs, application PDFs
• scanned applications in shared folders or someone's Downloads folder
• carrier portals and comparative rating tools
• laptops that go home at night
• personal phones used to photograph documents for a client

One helpful definition: the law says that acquiring encrypted data is not a "cybersecurity event" if the encryption key was not also taken or misused. Encrypting laptops and portable media is good security, and it can also mean a stolen laptop never becomes a reportable event.

If you lose the exemption: what the program has to include

Once an agency no longer qualifies, § 601.952 calls for a comprehensive written information security program based on a risk assessment and sized to the agency's size, complexity, vendors, and the sensitivity of its data. The main pieces:

• A risk assessment that covers staff training, how information is stored, sent, and disposed of, and how attacks are detected and handled, including information held by vendors
• A named person responsible for the program. The law allows an employee, an affiliate, or an outside vendor.
• Security measures, where appropriate: access controls, restricted physical access, encryption for data sent over external networks and stored on laptops or portable media, effective controls that may include multifactor authentication, monitoring for attacks, audit trails, protection against disasters and technology failures, and secure disposal in all formats
• A retention and disposal schedule for nonpublic information that is reviewed from time to time
• Security awareness training that stays current
• An annual check of whether the safeguards actually work
• A written incident response plan covering goals, the internal process, roles and decision authority, communications, fixing weaknesses, documentation, and review after an event
• Vendor oversight: due diligence when selecting third-party service providers, and reasonable efforts to require that they protect the data and report events
• Board oversight and annual reporting, if the agency has a board of directors

When the agency finds something that needs material improvement, it documents the problem and the fix, and keeps that documentation for five years.

A workable 180-day sequence

The law gives 180 days but no project plan. This order works well for a small agency because each step feeds the next:

1. Weeks 1 to 2: Confirm in writing that the exemption no longer applies. Name the responsible person. Tell your IT provider and your cyber insurance carrier.
2. Month 1: Inventory where nonpublic information lives: systems, shared folders, email, carrier portals, laptops, and vendors.
3. Month 2: Run the risk assessment against that inventory. Rank the gaps by likelihood and damage, not by what is easiest to fix.
4. Months 3 to 4: Close the big gaps. For most agencies that means multifactor authentication on email and remote access, encrypted laptops, tighter access to client folders, and a retention rule for old applications.
5. Month 5: Write the incident response plan and review vendor contracts and security terms.
6. Month 6: Train staff, schedule the annual review, and file the certification when it is due.

An exempt agency can do most of this voluntarily. Much of it is also what cyber insurance applications ask about. Our cyber insurance renewal checklist covers those controls from the carrier's side.

Where an IT provider fits, and where it does not

The law lets an outside vendor be the person responsible for the program, and an IT provider can do much of the technical work: the inventory, access controls, encryption, monitoring, audit logs, backups, and the technical half of the incident response plan.

Two limits are worth keeping in mind.

First, whether the agency is exempt, whether an event must be reported, and what customers are told are business and legal decisions. Your IT provider should give you facts quickly. Your owner, attorney, and carrier make the calls.

Second, if your IT provider can reach nonpublic information, it is a third-party service provider under this law. That means your program has to cover it too: due diligence when you hire it, security expectations in writing, and an obligation to report events to you. Ask your provider how it would meet those terms. A good one will have an answer.

Final thoughts

For most small Wisconsin agencies, the useful takeaway is not "we're exempt." It is this: we are exempt from the written program for now, but we still need to investigate, we may have a three-business-day clock with OCI, and we should know the day we stop qualifying.

Start small. Check the three exemption numbers, name who owns the decision to report, and write down where client data lives. That is an afternoon of work, and it makes the rest of the law much easier to handle.

If you would like help mapping where your agency's client data sits or preparing for the three-business-day window, our IT services for insurance agencies team works with agencies across Milwaukee, Waukesha, and southeastern Wisconsin. You can also ask about a cybersecurity assessment.

Sources and a legal note

• Wisconsin Legislature: Wis. Stat. ch. 601 subch. IX, Insurance Data Security
• Wis. Stat. § 601.952: Information security program and exemptions
• Wis. Stat. § 601.954: Notification of a cybersecurity event
• OCI: Insurance Cybersecurity
• OCI: Cybersecurity Annual Certification Form FAQs
• OCI Bulletin, September 30, 2021: 2021 Wis. Act 73

This article is general operational guidance, not legal advice. Statutes and OCI guidance can change; confirm current requirements with OCI or qualified counsel.