Data Breach Notification Laws by State and Deadlines

The panic in the first week of an incident is rarely about the intrusion. It is about the calendar. Somebody asks how long the company has to tell people, and the honest answer is that it depends on where those people live, what kind of data was taken, which regulator licenses the business, and which day a lawyer decides the clock started. There is no single federal breach notification statute for ordinary consumer data, so the obligation is assembled out of 50 state laws, a handful of sector rules and, for public companies, a securities filing. They do not agree with each other, and the strictest one wins.

What Are Data Breach Notification Laws?

A breach notification law is a disclosure duty, not a security standard. It does not tell you how to protect data. It tells you what you owe people once you have failed to, and the duty is triggered by a defined set of facts rather than by how bad the incident felt.

Three elements have to line up before the duty exists. The data has to be personal information as that state defines it. It has to have been unencrypted, or encrypted with the key also taken. And it has to have been acquired, or in some states merely accessed, by someone not authorized to have it. Miss any one of those and there may be no statutory notice to send, which is a very different position from having nothing to worry about.

The duty attaches to the organization that owns or licenses the data, which is why what legally counts as a breach matters more than what the security team calls it internally. A vendor that merely maintains data on your behalf usually owes notice to you, and you owe notice to the people.

Which States Have Data Breach Notification Laws?

Every one of them. California passed the first in 2002 and the last holdouts finished in 2018, and the Federal Trade Commission's guide to data breach response for business states the position plainly: all states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information.

Uniform coverage is not uniform law. The variation sits in four places, and each of them can change what you have to do: the deadline, the threshold that pulls in the attorney general, the definition of personal information, and whether an individual can sue you for getting it wrong.

Data Breach Notification Deadlines by State

The number of days is the part everybody quotes and the part that matters least on its own, because a 30-day clock that starts late is slower than a 60-day clock that starts on discovery. Here are seven states with numeric deadlines, taken from the statutes themselves.

The pattern in that table is the thing nobody prints. California, New York and Washington count from discovery. Colorado, Florida, Arizona and Delaware count from determination. Those are not synonyms, and the gap between them is where most of the argument in an incident actually happens.

The 31 states with no number are not the easy ones. "In the most expedient time possible and without unreasonable delay" is a standard a regulator applies with hindsight, using the date you first had a reason to look. A fixed 45 days is easier to defend than a vague duty you satisfied in 70.

When Do You Have to Notify the State Attorney General?

Consumer notice is only half the job in most of the country. Above a resident-count threshold, the state itself has to be told, usually through an online portal, and usually with a copy of the letter you sent.

Thresholds cluster at 500. Colorado, Florida and Washington all use it, Delaware requires attorney general notice above 500 Delaware residents no later than the time individuals are notified, and Arizona sets the bar higher at more than 1,000 individuals before the attorney general and the director of the state homeland security department have to hear about it. New York is the outlier that catches people: General Business Law 899-aa requires notice to the attorney general, the department of state and the state police whenever New York residents are notified, and attaches no resident count to that duty.

A third recipient is easy to miss. Several statutes also require notice to the national consumer reporting agencies once the incident is large enough, without any of the individuals having to be told twice: Florida sets that trigger at more than 1,000 individuals notified at a single time, and New York at more than 5,000 residents notified at once.

California splits the two events. Consumer notice goes out within 30 days, and then, when more than 500 California residents were notified in a single breach, a sample copy of that notice goes electronically to the attorney general within 15 calendar days of notifying consumers. That filing is not private. It lands on the attorney general's published breach list, searchable by company name, which is how most journalists and most plaintiffs' lawyers find out what a letter said.

What Counts as Personal Information Under State Breach Laws

The definition is the on-switch. If the exposed fields fall outside it, there is no statutory notice, however unpleasant the incident was.

The common core is a person's first name or initial and last name, combined with one of a short list of identifiers: Social Security number, driver's license or state ID number, or a financial account or card number with whatever code would allow access to the account. That combination is the identity theft toolkit, which is what these statutes were written to interrupt.

The list has been growing for a decade. California adds medical information, health insurance information, biometric data and genetic data, and separately covers a username or email address paired with a password or a security question answer that would permit access to an online account. That second class matters because it needs no name at all. The Privacy Rights Clearinghouse survey counts 22 states covering biometric identifiers explicitly, 24 covering medical or health data, and only 9 reaching breaches of paper records, which is why a stolen filing cabinet and a stolen database are treated very differently in most of the country.

Does Encryption Exempt You From Notifying?

Usually, and not automatically. Nearly every state statute is written to reach unencrypted personal information, so data that was properly encrypted at the time it was taken generally does not trigger notice. The exemption is doing real work: it is the reason a lost laptop with full-disk encryption is an IT problem rather than a 30-state filing exercise.

Two conditions decide whether you actually get the benefit. The encryption has to meet the standard the statute describes, and the key must not have gone out of the door with the data. California defines encrypted as rendered unusable, unreadable or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security. HIPAA takes the same approach from the other direction: 45 CFR 164.402 applies the breach notification rules only to unsecured protected health information, meaning information not rendered unusable, unreadable or indecipherable through a technology or methodology specified by the Secretary.

Getting encryption right is the cheapest breach notification insurance available, and it is worth mapping which data stores are covered while nothing is happening.

What a Breach Notification Letter Has to Say

State content requirements vary, but they converge on the same handful of items, and the fullest published list is the federal one. HIPAA's 45 CFR 164.404(c) requires the notice to include, to the extent possible, a brief description of what happened including the date of the breach and the date of discovery; a description of the types of information involved; the steps individuals should take to protect themselves; what the organization is doing to investigate, mitigate and prevent recurrence; and contact procedures including a toll-free number, email address, website or postal address. It also requires plain language, which is a legal requirement and not a style note.

Most state statutes ask for a subset of the same thing, and several add their own: a description of the incident in general terms, the type of information, the toll-free numbers for the credit reporting agencies, and the advice to report suspected identity theft to law enforcement. Delaware requires an offer of one year of credit monitoring at no cost where a Social Security number was involved, so the letter has to carry the offer and the enrollment mechanics.

Federal Breach Notification Rules That Stack on State Law

There is no general federal breach notification statute for consumer data. There are several sector-specific ones, and they add to state obligations rather than replacing them.

HIPAA also settles the question of whether an incident is a breach at all, and it settles it against you by default: under 164.402, an impermissible acquisition, access, use or disclosure of protected health information is presumed to be a breach unless the entity demonstrates a low probability of compromise using a risk assessment covering at least four factors, including whether the information was actually acquired or viewed. That presumption is stricter than most state laws, which is one reason healthcare organizations report more and why the wider obligations in the HIPAA Security Rule are worth reading alongside this. Card data carries no notification rule of its own, but PCI DSS obliges you to report a suspected compromise to the acquirer and the card brands under your contract, on their timetable rather than a statute's.

Who Has to Notify When a Vendor Is Breached?

This is the most common real situation and the one the state statutes handle in the fewest words. The split is between the entity that owns or licenses the data and the entity that merely maintains it. The maintainer notifies the owner. The owner notifies the people. A payroll processor that loses your employee records does not write to your employees; it writes to you, and then you write to them, on your state's clock.

HIPAA writes the same rule down precisely. Under 45 CFR 164.410 a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery, and must identify each individual involved. Read that against the covered entity's own 60-day clock and the arithmetic is unforgiving: a business associate that uses its full window leaves the covered entity with no time at all. Contracts are where that gets fixed, and 72 hours or 5 days is the number worth negotiating into every agreement before you need it.

Where a supplier is compromised, you are still the party with the notification duty and the reputational exposure, and you are dependent on somebody else's investigation for the facts your letter has to contain.

How to Comply With Breach Notification Laws in Multiple States

There is no shortcut, but there is a rule that resolves almost every conflict. You owe each affected person the law of the state they live in, so map your affected population by residency, then work to the strictest applicable clock and the broadest applicable content requirement. One letter satisfying the toughest state is cheaper to produce and easier to defend than a set of state-by-state variants, with inserts where a statute demands something extra.

What Are the Penalties for Failing to Notify?

Enforcement is mostly the state attorney general's, and the numbers in the statutes are specific enough to plan against.

Florida is the sharpest example. Section 501.171(9) sets civil penalties of $1,000 for each day up to the first 30 days following a violation of the notice provisions, then $50,000 for each subsequent 30-day period or portion of one, for up to 180 days. New York's General Business Law 899-aa allows a court to impose the greater of $5,000 or up to $20 per instance of failed notification, capped at $250,000. Arizona caps its penalties at the lesser of $10,000 per affected individual or the total economic loss sustained, with an overall ceiling of $500,000 for a breach or series of related breaches.

Private suits are the other exposure, and in California they are explicit: Civil Code 1798.84(b) provides that any customer injured by a violation of the title may bring a civil action to recover damages, and subsection (e) allows a violating business to be enjoined. The Privacy Rights Clearinghouse counts 24 states with some private right of action. The civil litigation that follows a large breach is usually the larger exposure, and the dates in your letter become the timeline everyone argues over.

The costs that are certain arrive before any penalty does: forensics, counsel, printing and postage at scale, a call center, and credit monitoring where a statute or the circumstances require it. Those are the line items cyber insurance policies are built around, and they are incurred whether or not a regulator ever opens a file.