Insights & Resources

If your business stores personal information about customers, employees, or partners, and virtually every business does, you have legal obligations when that information is compromised in a data breach. All 50 states, the District of Columbia, and U.S. territories now have data breach notification laws that require businesses to notify affected individuals when their personal information is exposed.

These are not optional guidelines. They are laws with specific requirements, defined timelines, and real penalties for non-compliance. Yet many small and mid-sized businesses are unaware of their obligations, have no plan for responding to a breach, and would struggle to comply with notification requirements if an incident occurred tomorrow.

Understanding your breach notification obligations before an incident happens is far less expensive and disruptive than trying to figure them out during a crisis.

What Triggers a Notification Requirement

Breach notification laws are triggered when there is unauthorized access to or acquisition of personal information. The specific definition of “personal information” varies by state but generally includes:

• Name combined with Social Security number, driver’s license number, state ID number, financial account numbers (with access codes or passwords), or medical/health information
• Biometric data (fingerprints, retinal scans, voiceprints) in an increasing number of states
• Login credentials (username or email combined with password or security questions) in many states
• Government-issued identification numbers including passport numbers and taxpayer IDs

The key word is “combined with.” A list of names alone typically does not trigger notification. But a list of names combined with Social Security numbers, account numbers, or medical information does.

Some states have expanded their definitions significantly. California’s CCPA and CPRA cover a broader range of personal information. States like Illinois have specific protections for biometric data under BIPA (Biometric Information Privacy Act) with private right of action, meaning individuals can sue directly.

Notification Timelines Vary Significantly

One of the most challenging aspects of breach notification compliance is that timelines vary by state, and if your business has customers in multiple states, you may need to comply with the most restrictive timeline.

Common notification windows:

• 30 days: Several states including Florida and Colorado require notification within 30 days of discovering the breach
• 45 days: States including Ohio and Washington require notification within 45 days
• 60 days: Many states use a 60-day notification window
• “Most expedient time possible”: Some states, including California, use language requiring notification “in the most expedient time possible and without unreasonable delay,” which courts have generally interpreted as 30-60 days

Federal requirements add additional layers:

• HIPAA: Healthcare organizations must notify affected individuals within 60 days and HHS within 60 days if the breach affects 500 or more individuals
• SEC: Publicly traded companies must disclose material cybersecurity incidents within four business days
• FTC: The FTC Health Breach Notification Rule applies to health apps and connected devices not covered by HIPAA

The clock typically starts when you discover the breach or when you reasonably should have discovered it, not when the breach actually occurred. This means that businesses without monitoring and detection capabilities may be in violation before they even know a breach happened.

Who Must Be Notified

Depending on the state and the size of the breach, you may need to notify:

Affected individuals. Every state requires notification to the people whose personal information was compromised. Notifications must include specific information: a description of the incident, the types of information involved, steps the business is taking, and steps individuals can take to protect themselves.

State attorneys general. Many states require notification to the state AG’s office, particularly when the breach affects a certain number of residents (commonly 500 or more). Some states require AG notification for all breaches regardless of size.

Credit reporting agencies. When a breach affects a large number of residents (typically 500-1,000 or more, depending on the state), businesses must notify the major credit reporting agencies.

Regulatory bodies. Industry-specific regulators may have additional notification requirements. Healthcare organizations notify HHS. Financial institutions may need to notify their primary federal regulator.

The Cost of Non-Compliance

Failing to comply with breach notification requirements can result in:

State AG enforcement actions. State attorneys general can investigate and bring enforcement actions against businesses that fail to notify or that delay notification unreasonably. Penalties vary by state but can reach $5,000-$7,500 per violation (per affected individual) in states like California.

Class action lawsuits. Affected individuals may bring class action lawsuits, particularly in states with private right of action provisions. Even if individual damages are small, the aggregate liability across thousands of affected individuals can be substantial.

Regulatory penalties. Industry-specific penalties can be severe. HIPAA violations can result in fines up to $2 million per violation category per year. FTC enforcement actions can include ongoing compliance monitoring and reporting requirements.

Reputational damage. Delayed or inadequate breach notification damages customer trust and can result in lost business that far exceeds the direct legal costs.

Building a Breach Response Plan

The time to prepare for a data breach is before it happens. A documented incident response plan that addresses notification requirements ensures that your business can respond quickly and comply with legal obligations when an incident occurs.

Know Your Data

You cannot notify people about compromised data if you do not know what data you have or where it is stored. Maintain a data inventory that documents:

• What personal information your business collects and stores
• Where that data resides (databases, file servers, cloud services, email, paper records)
• Who has access to it
• What states your customers and employees reside in (this determines which notification laws apply)

Document Your Response Procedures

Your incident response plan should include:

• Detection and assessment: How will you identify that a breach has occurred? What constitutes a reportable breach versus a security incident that does not trigger notification?
• Containment: Steps to stop the breach and prevent further data exposure
• Investigation: How to determine what data was compromised, how many individuals are affected, and what states are involved
• Legal review: When to engage legal counsel to assess notification obligations
• Notification execution: Templates for notification letters, procedures for AG notification, and processes for credit monitoring enrollment if offered
• Documentation: Record-keeping throughout the process to demonstrate compliance

Identify Your Legal Counsel in Advance

Do not wait until a breach occurs to find a lawyer who understands data breach notification law. Identify legal counsel with breach response experience before you need them. Many cyber insurance policies include access to breach response legal counsel as part of the coverage.

Test Your Plan

A plan that has never been tested is a plan that will fail under pressure. Conduct tabletop exercises at least annually where key personnel walk through a simulated breach scenario, make decisions about notification, and identify gaps in the plan.

Reducing Your Breach Risk

The best breach notification strategy is not needing to use it. Implementing strong security controls reduces the likelihood of a breach and demonstrates due diligence if one occurs.

Encrypt sensitive data at rest and in transit. Many state breach notification laws include safe harbor provisions that exempt businesses from notification requirements if the compromised data was encrypted and the encryption key was not compromised.

Implement access controls that limit who can access personal information to those who need it for their job function.

Monitor for unauthorized access through audit logging, intrusion detection, and anomaly alerting.

Train employees on data handling procedures and security awareness.

Manage vendor risk by ensuring that third parties who handle your data have appropriate security controls and contractual obligations for breach notification.

JayTec Solutions helps businesses understand their breach notification obligations, build incident response plans, and implement the security controls that reduce breach risk. From compliance assessments and policy development to technical controls and employee training, a proactive approach to data protection is both a legal obligation and a business imperative.

The question is not whether your business will face a security incident. It is whether you will be prepared to respond in compliance with the law when it happens.