LA SB386

Creates the Louisiana Data Privacy Act establishing consumer rights to confirm, access, correct, delete, and obtain portable copies of personal data, and to opt out of targeted advertising, data sales, and certain profiling

Applies to non-small businesses that conduct business in Louisiana, process or sell personal data; exempts state agencies, financial institutions, nonprofits, higher education institutions, electric utilities, and HIPAA-covered entities

Requires controllers to respond to consumer requests within 45 days, provide clear privacy notices disclosing data categories and processing purposes, and conduct data protection assessments for targeted advertising, data sales, and sensitive data processing

Authorizes attorney general enforcement with $7,500 civil penalties per violation after a 30-day cure period; also creates private right of action allowing consumers to recover up to $7,500 per incident or actual damages after 30-day notice

Defines sensitive data as racial/ethnic origin, religious beliefs, health diagnoses, sexuality, citizenship status, biometric data, children's data, and precise geolocation data—requiring consumer consent before processing