---
title: "Louisiana privacy law: controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/louisiana/controller-duties"
source: "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Louisiana Data Privacy Act

# Louisiana privacy law: controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. The privacy notice must cover categories of data, purposes, how to exercise and appeal rights, categories of data sold and of buyers, and the request methods. Data protection assessments are required from 1 January 2027 for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. Opt-out signals sent through an authorized agent technology must be honoured if the controller can verify them, with several exceptions.

## Key points

1. Collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes.

   Section: [La. R.S. 51:1780.4(A)(1)(a)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

2. Reasonable administrative, technical and physical security practices.

   Section: [La. R.S. 51:1780.4(A)(1)(b)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

3. Privacy notice: categories of data (including sensitive), purposes, how to exercise and appeal rights, categories of data sold and of buyers, and request methods.

   Section: [La. R.S. 51:1780.4(B)(1)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

4. Sale and targeted advertising must be disclosed clearly, with the opt-out method.

   Section: [La. R.S. 51:1780.4(C)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

5. Opt-out through an authorized agent technology (browser setting, extension or global device setting) must be honoured if verifiable, unless the request is unclear, residency cannot be verified, the controller cannot process it, or the controller does not process similar requests under other states' laws.

   Section: [La. R.S. 51:1780.3(E)(5), (6)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

6. Data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; available to the Attorney General on a civil investigative demand.

   Section: [La. R.S. 51:1780.4(E)](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

## Sources

- [Act No. 502 of 2026 (SB 386), signed act text](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Louisiana statute](https://legis.la.gov/legis/ViewDocument.aspx?d=1480202)

Reference material, not legal advice.

## Other topics for Louisiana

- [Applicability](https://dposchool.com/state-privacy-laws/state/louisiana/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/louisiana/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/louisiana/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/louisiana/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/louisiana/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/louisiana/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/louisiana/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents