What is a breach notification law? State and federal notice duties after a breach, defined

A breach notification law is a statute or rule that requires an organization whose systems exposed personal information to notify the people affected, and often a regulator, within a fixed number of days or without unreasonable delay. In the United States every state has one, and federal rules add separate duties for health, financial and securities firms.

How the state layer works

The Federal Trade Commission (FTC) counts a notification law in every state, the District of Columbia, Puerto Rico and the Virgin Islands. New York's General Business Law § 899-aa shows the level of detail: notice in the most expedient time possible and without unreasonable delay, within 30 days of discovery, with copies to the attorney general, the Department of State, the Division of State Police and the Department of Financial Services.

New York also lets a court impose a civil penalty for a knowing or reckless violation: the greater of $5,000 or up to $20 per failed notification, with the per-notification amount capped at $250,000.

The federal layer

Sector rules sit on top. Under an amendment to the FTC's Safeguards Rule announced on 27 October 2023, non-bank financial institutions must notify the FTC no later than 30 days after discovering a breach of unencrypted information about at least 500 consumers. The requirement took effect 180 days after Federal Register publication.

The Securities and Exchange Commission (SEC) amended Regulation S-P on 16 May 2024. Its amendments require covered institutions to notify individuals whose sensitive customer information was, or is reasonably likely to have been, accessed without authorization, as soon as practicable and within 30 days of becoming aware. Health data has its own federal regime, the HIPAA Breach Notification Rule.

How it shows up in the record

Alongside SEC filings, this site's incident log carries breach notices filed with the California and Washington attorneys general; the City of Foster City entry is one. A public company can owe a state notice and a Form 8-K Item 1.05 filing for the same incident, on different clocks, and the same incident can also lead to a data breach class action.

What it is not

A notification law sets who must be told and when. It is not a securities disclosure to investors, and it is not the EU regime, where GDPR Article 33 governs notice to a supervisory authority.

Where it appears on cisonews.net

Data breach notification laws by state reads twelve state statutes directly, with deadlines and attorney general thresholds side by side.