Data Breach Notification Laws: A State-by-State Guide for Small Businesses

The United States has a patchwork of state data breach notification laws. There is no comprehensive federal breach notification statute that covers all industries (though sector-specific federal laws like HIPAA and GLBA impose their own notification requirements for health and financial data). All 50 states, plus the District of Columbia, Puerto Rico, and the US Virgin Islands, have enacted data breach notification laws. These laws require businesses to notify residents when their personal information has been compromised in a security incident. But the laws are not uniform: they differ in what triggers notification, what personal information is covered, how quickly notice must be provided, what the notice must say, and whether the attorney general must be notified.

When Does a Breach Trigger Notification?

Under most state breach notification laws, a business must notify affected residents when personal information is acquired, accessed, or disclosed by an unauthorized party. The specific triggering standard varies. Some states require notification only when there is a reasonable likelihood that the breach will result in harm to the affected individual. Others require notification for any unauthorized access to personal information, regardless of whether harm is likely. A few states apply a risk-of-harm threshold that requires a facts-and-circumstances analysis similar to HIPAA’s risk assessment framework.

Most state laws apply a safe harbor for encrypted data: if the personal information involved in the breach was encrypted and the encryption key was not also compromised, notification may not be required. This is one of the most important practical reasons to encrypt personal data at rest and in transit — not just as a security measure, but because it can convert a potential notification-triggering incident into one that does not require notification.

What Personal Information Triggers the Obligation?

State breach notification laws protect different categories of personal information. All state laws cover a baseline set of information that has historically been used for identity theft: name combined with Social Security number, driver’s license or state ID number, and financial account numbers combined with access credentials. These are the original triggers for most state notification laws, enacted in the early 2000s after a series of high-profile identity theft incidents.

In recent years, many states have significantly expanded the categories of personal information that trigger notification obligations. Medical information, health insurance information, username or email address combined with a password or security question, biometric data, passport numbers, tax ID numbers, and in some states simply an individual’s name with a home address are now covered by breach notification laws in various states. California, in particular, has one of the broadest definitions of covered personal information, and a California breach may trigger notification even if the data involved would not trigger notification in other states.

Notification Timelines: The Wide Range of Deadlines

One of the most practically challenging aspects of multi-state breach notification is the range of notification deadlines. Most states require notification without unreasonable delay or within a specified number of days of discovering the breach. The specific deadlines range considerably. Florida and several other states require notification within 30 days of determining that a breach has occurred. Many states use a 45-day window. Some states require notification within 60 days. A small number of states have no specified deadline beyond ‘expedient’ or ‘without unreasonable delay.’

For a business with customers in multiple states, the operative deadline is typically the most restrictive one applicable to any of the affected individuals. If even one Florida resident was affected by a breach, the 30-day deadline applies to the notification for that resident. The practical approach is to build a breach response process that targets the most restrictive applicable deadline and to have your investigation, notification content, and delivery mechanism ready within that window.

Notification to State Attorneys General

In addition to notifying affected individuals, many state breach notification laws require businesses to notify the state attorney general when a specified number of state residents are affected. The threshold for mandatory AG notification varies. Some states require notification to the attorney general whenever any resident is notified. Others require notification only when the breach affects 500 or more, 1,000 or more, or some other threshold number of state residents. The timing of AG notification is typically the same as individual notification, though some states require simultaneous notification and others provide a short additional window.

AG notification is significant because it effectively puts the breach in the public record and can trigger regulatory scrutiny. State attorneys general offices that receive breach notifications review them to assess whether the business maintained adequate security practices, provided timely notice, and otherwise complied with applicable law. Systemic security failures, delayed notifications, or other compliance problems discovered through breach investigations can result in enforcement actions by state attorneys general.

What Must the Notification Say?

State laws specify various requirements for the content of breach notifications to affected individuals. At minimum, most laws require a description of what happened, the type of personal information involved, the steps the business is taking in response, contact information for the business, and information about the steps affected individuals can take to protect themselves (such as monitoring credit reports, placing fraud alerts, or requesting credit freezes). Some states require specific disclosures about credit monitoring services, credit freeze rights, or free credit report entitlements.

The notification should be written in plain language that is understandable to ordinary consumers. Some states specifically require that notifications be provided in languages other than English for populations that primarily speak another language. The timing, form, and delivery of the notification — whether by mail, email, or substitute notice such as website posting — are also specified in many state laws.

Federal Sector-Specific Notification Requirements

In addition to state breach notification laws, several federal sector-specific laws impose their own notification requirements that apply alongside and in addition to state law. HIPAA’s Breach Notification Rule requires notification to affected patients, HHS, and in some cases the media when PHI is breached. The Gramm-Leach-Bliley Act’s Safeguards Rule requires financial institutions to notify customers and the FTC of security incidents that constitute a notification event. The SEC requires public companies to disclose material cybersecurity incidents within four business days of determining materiality. The FTC has also finalized a breach notification rule for non-bank financial institutions.

Businesses subject to these federal requirements must comply with both the federal and applicable state requirements, and must ensure that the federal and state timelines are both met.

Preparing for a Breach Before It Happens

The most effective way to manage the complexity of multi-state breach notification is to prepare before any breach occurs. A written incident response plan should identify the members of the incident response team, the immediate steps to take upon discovering a potential breach, the process for engaging legal counsel and forensic support, the framework for assessing whether notification is required and to which states, and the mechanics of providing notification within the applicable deadlines.

The plan should also identify which state’s laws are most relevant based on where the business’s customers and employees are located, so that the team is not starting from scratch when a real incident occurs. Relationships with outside legal counsel who can assist with multi-state notification analysis and with a cyber forensics firm that can rapidly assess the scope of an incident are valuable to establish in advance. And cyber liability insurance, which typically covers breach notification costs and may cover related regulatory defense costs, should be evaluated as part of the business’s overall risk management strategy.