Data Breach Notification Requirements by State
Every State Has Its Own Law
All 50 states, plus the District of Columbia and several U.S. territories, have enacted their own data breach notification laws. They differ on the notification deadline, what counts as “personal information” that triggers the law, whether you must notify a state attorney general in addition to affected individuals, and what the notification itself must include.
Why This Matters for a Multi-State Business
If your business operates in more than one state, or if affected customers live in different states, you may be subject to multiple notification laws for the same single incident, each with its own deadline and requirements. Your breach coach’s job includes mapping exactly which laws apply to your specific incident.
Find Your State
We maintain a dedicated page with the specific breach notification law for every state we serve. Start with the state where your business is licensed and operates:
- Alabama
- Arizona
- California
- Colorado
- Connecticut
- Florida
- Georgia
- Illinois
- Indiana
- Iowa
- Kentucky
- Maryland
- Michigan
- Minnesota
- Missouri
- Montana
- Nevada
- New Jersey
- New York
- North Carolina
- Ohio
- Pennsylvania
- South Carolina
- Tennessee
- Texas
- Utah
- Virginia
- West Virginia
What to Do With This Information
This page is a starting point, not a substitute for your breach coach’s legal determination once an actual incident occurs. The specific facts of your incident (what data was accessed, how many residents of each state were affected) determine exactly which obligations apply, and your insurer’s panel attorney is who makes that call in real time.
Get Covered Before You Need This
A breach coach, forensics team, and claims process already in place beats finding one under pressure.