AR HB1943

Adds biometric data to the definition of "personal information" under Arkansas's Personal Information Protection Act, including fingerprints, faceprints, retinal/iris scans, hand geometry, voiceprint analysis, DNA, and other unique biological characteristics used for identity authentication.

Requires persons or businesses maintaining personal information to notify the owner or licensee of any security breach immediately following discovery if personal information was acquired by an unauthorized person.

Requires notification to the Arkansas Attorney General within 45 days if a security breach affects more than 1,000 individuals, or at the same time notification is made to affected individuals, whichever occurs first.

Mandates retention of written breach determinations and supporting documentation for five years, with persons or businesses required to provide copies to the Attorney General within 30 days of a written request.

Classifies retained breach determinations and documentation as confidential and not subject to public disclosure.