Data Breach Notification Requirements in the US: Who Must Be Told and When

The worst part of a data breach often isn’t the hack itself. It’s the week after, when you realize you don’t know who you’re legally required to tell, by when, or what the letter must say. Miss a deadline and a bad situation becomes an enforcement action.

US breach notification law is a patchwork. There’s no single federal law covering every business. Instead, each state has its own statute, and federal rules layer on extra duties for healthcare, financial services, public companies and some critical infrastructure. The rules that apply depend mostly on where the affected people live, not where your business is based.

This guide explains how the system works, the deadlines you’re most likely to face and a practical process for the first 30 days. This is not legal advice. Breach response is a moment to bring in a qualified attorney.

How US breach notification works

Every US state has a breach notification law, as do the District of Columbia, Guam, Puerto Rico and the US Virgin Islands. Alabama and South Dakota were the last states to pass theirs, in 2018. Most of these laws share the same basic structure:

1. A trigger. Unauthorized access to or acquisition of “personal information,” usually a name combined with a sensitive element such as a Social Security number, driver’s license number, financial account number with access code, or, in many states, medical, biometric or login credentials.
2. An encryption safe harbor. Most states don’t require notice if the data was encrypted and the key wasn’t also compromised.
3. A risk-of-harm test in some states, letting you skip notice if an investigation finds harm is unlikely. Other states require notice regardless.
4. A deadline, either “without unreasonable delay” or a fixed number of days.
5. Who to notify: affected residents, often the state attorney general above a certain count, and sometimes consumer reporting agencies.

Because each state defines these elements differently, a single breach affecting customers in 20 states can trigger 20 slightly different sets of rules.

Key takeaway: The law that applies is the law of the state where each affected person lives. A small online store in Ohio with customers in California, New York and Texas must follow all 3 states’ rules for those customers.

State deadlines are getting shorter

Many older laws only said “in the most expedient time possible.” The trend in recent years has been toward fixed deadlines. A few examples from official sources:

California’s law also specifies the notice format: plain language, titled “Notice of Data Breach,” with headings such as “What Happened?” and “What Information Was Involved?”

These details change often. Before relying on any deadline, check the current statute text or your state attorney general’s breach page. Our overview of state privacy laws covers the separate consumer privacy statutes that sit alongside these breach rules.

Federal rules that add extra duties

Some industries face federal notification rules on top of state law.

HIPAA details. HHS guidance says covered entities must notify individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting fewer than 500 people may be reported to HHS annually, within 60 days of the end of the calendar year. Business associates must notify the covered entity within 60 days. If you handle health data, see our HIPAA security risk assessment guide.

FTC Safeguards Rule. The FTC’s notice asks for basics such as dates, the number of consumers affected, the types of data involved and a short summary. Our FTC Safeguards Rule guide covers the rest of the rule.

Public companies. The SEC clock starts at the materiality determination, not at discovery, though the determination itself must be made without unreasonable delay. See our explainer on SEC cybersecurity disclosure rules.

What about CIRCIA?

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered critical infrastructure entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. However, CISA’s own CIRCIA page says organizations are not required to submit these reports until the final rule takes effect. CISA published its proposed rule in April 2024 and says it is still working on the final rule. Check CISA.gov/CIRCIA for the current status rather than relying on news reports of expected dates.

Who you may need to notify

After a breach, build a notification map. Depending on the facts, it may include:

• Affected individuals, by mail or email, following each state’s content rules.
• State attorneys general or other agencies, often once a threshold such as 250 or 500 residents is passed.
• Consumer reporting agencies (Equifax, Experian, TransUnion) when large numbers are affected; New York, for example, requires this above 5,000 residents.
• Federal regulators, such as HHS, the FTC, your bank regulator or the SEC.
• Your cyber insurer, usually as soon as possible. Many policies require prompt notice and approved vendors; see cyber insurance requirements.
• Business customers or data owners. If you’re a vendor holding someone else’s data, most laws require you to notify the data owner, who then notifies individuals.
• Law enforcement, such as the FBI’s IC3, which may also request a delay in public notice.

Where to start: the first 30 days

1. Day 0–1: Contain and preserve. Stop the bleeding, but don’t wipe systems. You need evidence to decide what data was accessed. See our guide to digital forensics.
2. Day 0–2: Call your insurer and outside counsel. Counsel can direct the investigation and help protect privilege.
3. Day 1–10: Scope the data. Identify which records were exposed, what fields they included and where each affected person lives.
4. Day 3–10: Check encryption and risk-of-harm. These may remove the duty to notify in some states.
5. Day 5–15: Build your notification map of states, federal regulators and contracts.
6. Day 10–25: Draft notices that meet the strictest content rules, and set up a call center or FAQ page if numbers are large.
7. By the earliest deadline: Send notices and file regulator reports. Keep proof of mailing and copies of everything.
8. After: run a lessons-learned review and update your incident response plan.

Practicing this sequence in a tabletop exercise before you need it is the best way to avoid missing a deadline. If you’re on the receiving end of a breach notice, our guide on what to do after a data breach walks through the steps for individuals.

Common mistakes to avoid

• Waiting for a complete investigation. Some states now set hard deadlines. New York’s current statute, for example, sets 30 days from discovery, with delay allowed for law enforcement needs.
• Using only your home state’s law. The residence of each affected person controls.
• Forgetting vendor duties. If your payroll or IT provider was breached, your data may be in scope.
• Vague notices. Several states mandate specific content, such as contact information and a description of what happened.
• Not documenting the decision not to notify. If you rely on encryption or a risk-of-harm exception, write down the analysis.

The bottom line

US breach notification is a state-by-state system with federal overlays for health, finance and public companies. Deadlines of 30 days are becoming common, and some federal clocks are far shorter. Know where your customers live, know which federal rules apply to you, and have counsel and your insurer on speed dial before anything goes wrong.

This is not legal advice. Breach notification laws change frequently; confirm current requirements with an attorney and the official statutes.

Sources

• California SB 446, Data breaches: customer notification (2025) — 30-day consumer deadline and Attorney General sample notice
• New York General Business Law 899-aa — 30-day deadline and state agency notice
• Texas Attorney General: Data Breach Reporting — 250-resident threshold and 30-day AG notice
• HHS: HIPAA Breach Notification Rule — HIPAA individual, media and HHS notice requirements
• FTC: Safeguards Rule notification requirement now in effect — 30-day FTC notice for non-bank financial institutions
• CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022 — CIRCIA requirements and rulemaking status