Missouri insurance data security law for agencies

By Tyler Mayberry · Cirlet. Published 2026-10-28. Page updated 2026-10-28.

A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.

Missouri’s Insurance Data Security Act, sections 375.1400 to 375.1427 RSMo, took effect on January 1, 2026. Licensees must notify the Director no later than four business days after determining that a qualifying cybersecurity event occurred. The written information security program is due by January 1, 2027.

The rules at a glance

Insurance data security law	Insurance Data Security Act, §§ 375.1400–375.1427 RSMo, effective January 1, 2026 (§ 375.1427)
Written information security program	Required under § 375.1405 by January 1, 2027. The third-party service provider requirements in § 375.1405.6 apply from January 1, 2028 (§ 375.1427).
Notice to the Director	“As promptly as practicable, but in no event later than four business days” from determining that a qualifying cybersecurity event occurred (§ 375.1410.1), using the Department’s electronic form (Bulletin 26-01).
Small-agency exceptions	A licensee with fewer than ten employees, including independent contractors, is exempt from § 375.1405. Section 375.1417.1(4) also lists “Producers that have fewer than fifty employees; less than five million dollars in gross annual revenue; or less than ten million dollars in year-end total assets” without naming the section it exempts them from. Ask the Department or your counsel how it applies to your agency.
General breach notice (any business)	Affected Missouri consumers must be notified “without unreasonable delay”. If more than 1,000 consumers are notified at one time, also notify the Attorney General’s office and the nationwide consumer reporting agencies (§ 407.1500 RSMo).

NAIC model law: Adopted. Missouri is one of the 28 jurisdictions the NAIC shows as adopting its Insurance Data Security Model Law (status as of October 8, 2026).

Missouri agencies’ public email records

In our October 2026 check of 180 Missouri independent agency website domains, 157 (87%) published one SPF record, 89 (49%) published a DMARC record and 50 (28%) asked receivers to quarantine or reject mail that fails. Public records show what a domain asks of receivers. They do not show whether an agency’s accounts or inboxes are protected.

What to prepare now

Write down who decides that a cybersecurity event has occurred, and who files the notice, with a backup person.
Keep the regulator’s notice route and the deadline above where you can reach them when email is unavailable.
Ask your IT provider for evidence of multi-factor authentication on email and agency systems, and a list of everyone with administrator access.
List the vendors that hold client information and how each will tell you about an incident.

Rehearse losing email access · Prepare for email fraud

Missouri questions

When did Missouri’s insurance data security law take effect?

January 1, 2026. Licensees have until January 1, 2027 to implement the written information security program in § 375.1405, and until January 1, 2028 for its third-party service provider subsection (§ 375.1427).

How fast must a Missouri agency report a cybersecurity event?

No later than four business days after determining that a qualifying event occurred (§ 375.1410.1). The Department asks licensees to use its electronic notification form (Bulletin 26-01, January 5, 2026).

Is a small Missouri agency exempt?

Partly, depending on size. A licensee with fewer than ten employees, including independent contractors, is exempt from the information security program requirement. A separate exception lists producers with fewer than fifty employees, under $5 million in revenue or under $10 million in assets. Confirm with the Department or counsel what that exception covers before relying on it.

Sources

Other states: Ohio · New York · Texas · California · All state pages