Louisiana Data Privacy Act (SB 386) — 22nd State Comprehensive Privacy Law

us-la Jan 1, 2027 Tracker lead

What just shifted

What this adds: Louisiana's LDPA takes effect January 1, 2027 — the 22nd state comprehensive privacy law and one of the fastest post-enactment effective dates in the current state privacy wave — using a 'doing business in Louisiana' jurisdictional hook that is narrower than most peer states but covers any entity above the revenue or data-volume thresholds.

What this puts in question: Whether multistate businesses that cross the LDPA's thresholds (including the $25M revenue floor, which captures many mid-size companies) have Louisiana on their 2027 compliance calendar and whether their sensitive-data handling practices for Louisiana residents are consent-ready before the cure period expires.

What clients should weigh

·The LDPA's $25 million revenue threshold is low enough to capture mid-market companies that may not have prioritized Louisiana as a privacy-law jurisdiction. Does your compliance team have Louisiana on the 2027 calendar?

·The 30-day cure period (January–July 2027) is shorter than Vermont's 18-month cure window. If a Louisiana AG investigation opens in February 2027, you have 30 days to cure — not a quarter or a year. Is your privacy program capable of responding at that pace?

·This addresses the LDPA. It does not confirm whether Louisiana has a data broker registration statute or biometric privacy provisions that would layer additional obligations on top of the LDPA's baseline.

Louisiana SB 386 (2026), Louisiana Data Privacy Act (LDPA), effective January 1, 2027

Ready to use

To-be-edited before sending to a client.

Client alert

Watch item — no client alert until confirmed operative.

Blog post

Watch item — no blog post until confirmed operative.