Question 1

How quickly must I notify individuals after a data breach?

Accepted Answer

Notification deadlines vary by state. Florida, Colorado, and Washington have some of the shortest deadlines at 30 days. Texas, Connecticut, Virginia, and several others require notification within 60 days. Many states, including California, New York, and Illinois, require notification "in the most expedient time possible" without a specific day count. If your breach affects residents in multiple states, you must meet the shortest applicable deadline.

Question 2

When do I need to notify the Attorney General about a data breach?

Accepted Answer

Most states require Attorney General (AG) notification, but the thresholds vary. New York, Illinois, and Massachusetts require AG notification for any breach affecting state residents. California, Florida, and Washington require notification when 500+ residents are affected. Oregon and North Dakota have a 250-person threshold, while Maryland requires notification at 1,000+. Some states like Georgia, Michigan, and Oklahoma do not require AG notification at all.

Question 3

Does encryption protect me from breach notification requirements?

Accepted Answer

Most states have an encryption safe harbor, meaning that if the compromised data was encrypted and the encryption key was not also compromised, you may not be required to notify affected individuals. However, the safe harbor only applies if the encryption was implemented properly and the key remained secure. You should still consult legal counsel to confirm whether the safe harbor applies to your specific situation.

Question 4

Which states require credit monitoring after a data breach?

Accepted Answer

Several states require free credit monitoring when Social Security numbers are compromised. Connecticut requires 24 months of credit monitoring (the longest). Massachusetts requires 18 months. California, Florida, Delaware, Maine, and Rhode Island require 12 months. The specific trigger is typically the compromise of Social Security numbers, though requirements vary by state.

Question 5

What is substitute notice and when can I use it?

Accepted Answer

Substitute notice is an alternative notification method (such as website posting and media notification) that businesses can use when direct notification would be cost-prohibitive. Most states allow substitute notice when the cost of direct notification exceeds a certain threshold (typically $100,000-$500,000) or when the number of affected individuals exceeds the entity's contact information capacity. The specific thresholds vary by state.

Data Breach Notification Comparison Tool

Which States Are Affected by the Breach?

Data Breach Notification Comparison Tool

Which States Are Affected by the Breach?