The Louisiana Data Privacy Act establishes comprehensive regulations for consumer data privacy, focusing on the responsibilities of data controllers and processors while defining consumer rights related to personal data. Key provisions include the requirement for clear consumer consent for data processing, the establishment of definitions for terms such as "personal data" and "sensitive data," and the delineation of enforcement mechanisms. The Act applies to businesses with annual gross revenues exceeding $25 million, those sharing personal information of 75,000 or more consumers, or those deriving 50% or more of their revenue from selling personal information. Notably, it exempts state agencies, financial institutions, healthcare entities, nonprofit organizations, and educational institutions from its provisions.

The bill emphasizes consumer autonomy by allowing individuals to request access, correction, deletion, and opt-out options for their data, with controllers required to respond within specified timeframes. It mandates that data controllers limit the collection of personal data to what is necessary and implement reasonable security practices. Additionally, it prohibits processing personal data for unrelated purposes without consumer consent and requires prior consent for the sale of sensitive personal data. The attorney general will oversee enforcement, providing information on consumer rights and controller responsibilities, and must notify parties of potential violations before initiating investigations. The Act is set to take effect on January 1, 2027.