FCC CPNI Breach Rule
Amended United States (Federal) · In force Mar 13, 2024 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Mar 13, 2024 | Order effective except revised notification rules2.5 years ago | 2.5 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
The 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.
- Who it applies to
- Telecommunications carriers, interconnected VoIP providers, and telecommunications relay service (TRS) providers. As adopted, breaches affecting fewer than 500 customers with no reasonable likelihood of harm may be reported in an annual summary.
- Penalties
- Forfeitures under the Communications Act (47 U.S.C. 503); no rule-specific amount.
- Enforced by
- Federal Communications Commission (Enforcement Bureau)
- Official name
- FCC Data Breach Reporting Requirements for telecommunications carriers, interconnected VoIP and TRS providers (47 CFR 64.2011, 64.5111)
- Citation
- 47 CFR 64.2011 and 64.5111; FCC 23-111, WC Docket No. 22-21; 89 FR 9968 (Feb. 12, 2024)
- Topics
- privacy, breach-notification, cybersecurity
Research notes
As of 2026-09-22 eCFR still shows the revised 64.2011 as a pending amendment (89 FR 10002) and no Federal Register notice announcing its effective date was found. The Sixth Circuit upheld the order in Ohio Telecom Ass'n v. FCC (Aug. 2025).
Related
CIRCIAQuestions about FCC CPNI Breach Rule
- What are the FCC CPNI Breach Rule compliance deadlines?
- Mar 13, 2024: Order effective except revised notification rules.
- When does FCC CPNI Breach Rule take effect?
- FCC CPNI Breach Rule took effect on Mar 13, 2024.
- Who does FCC CPNI Breach Rule apply to?
- Telecommunications carriers, interconnected VoIP providers, and telecommunications relay service (TRS) providers. As adopted, breaches affecting fewer than 500 customers with no reasonable likelihood of harm may be reported in an annual summary.
- What are the penalties under FCC CPNI Breach Rule?
- Forfeitures under the Communications Act (47 U.S.C. 503); no rule-specific amount.