(a) To conduct business in this state, a data broker to which this chapter applies shall register with the secretary of state by filing a registration statement and paying a registration fee of $300.
(b) The registration statement must include:
(1) the legal name of the data broker;
(2) a contact person and the primary physical address, e-mail address, telephone number, and Internet website address for the data broker;
(3) a description of the categories of data the data broker processes and transfers;
(4) a statement of whether or not the data broker implements a purchaser credentialing process;
(5) if the data broker has actual knowledge that the data broker possesses personal data of a known child:
(A) a statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the personal data of a known child; and
(B) a statement on how the data broker complies with applicable federal and state law regarding the collection, use, or disclosure of personal data from and about a child on the Internet; and
(6) the number of security breaches the data broker has experienced during the year immediately preceding the year in which the registration is filed, and if known, the total number of consumers affected by each breach.

(c) A registration of a data broker may include any additional information or explanation the data broker chooses to provide to the secretary of state concerning the data broker’s data collection practices.
(d) A registration certificate expires on the first anniversary of its date of issuance. A data broker may renew a registration certificate by filing a renewal application, in the form prescribed by the secretary of state, and paying a renewal fee in the amount of $300.