US State Breach Notification Laws: A Working Guide

Key takeaways

• All fifty states have a breach notification statute. There is no single federal breach law for general data; the state layer is the default, and multi-state incidents mean multiple simultaneous obligations.
• Most clocks say "without unreasonable delay" with no fixed day count. A minority of states add hard deadlines, and the shortest common ones run at 30 days.
• Encryption is the most common safe harbor. Encrypted data with keys not compromised is excluded in most statutes, which makes strong encryption a legal control, not just a security one.
• Notification starts at discovery and is driven by residency, not location. Your obligations follow where the affected people live, so an incident in one state usually means notifications under many.
• HIPAA-covered data follows HIPAA first. Health data in a covered context answers to the HIPAA breach rule, with state laws typically applying only where they are stricter.

The shared skeleton

Most state statutes follow the same five-part shape, and your response plan should track all five:

1. Trigger: unauthorized acquisition of, or access to, defined personal information. Most statutes are acquisition-based, some are access-based, and the definition of personal information varies (most combine name plus a sensitive identifier; some add biometrics, tax IDs, or login credentials).
2. Risk-of-harm test: most states allow withholding notification when the breach does not create a material risk of harm, and most require documenting that assessment.
3. Recipients: affected residents, the state attorney general (usually above a threshold, commonly 500 or 250 residents), and consumer reporting agencies above larger thresholds.
4. Timing: "without unreasonable delay" in most states; a subset adds fixed deadlines (see below).
5. Content and substitute notice: required elements in the notice, and rules for substituted notice (email, website posting) when contact data is stale or the class is large.

The pattern breakers: states with fixed deadlines

When your incident touches these states, the calendar hardens:

• 30 days: Colorado, Florida, Maine, North Dakota, Washington, and others, from discovery
• 60 days: Texas (for breaches affecting 250+ residents)
• Specific accelerators: some states shorten the clock for specific data types (for example, credential-only breaches in some statutes carry their own notice rules)

The practical rule: build the notification matrix against the strictest applicable state in your data footprint, not the average one, and let one process satisfy the many.

How the layers stack

A single incident can answer to several regimes at once:

• HIPAA data: the HIPAA breach rule governs first in covered contexts; states mostly defer or add stricter terms only.
• EU/UK residents: GDPR's 72-hour clock runs in parallel with the state layer; one process, two timelines.
• Public companies: material incidents trigger Item 1.05 Form 8-K disclosure to the SEC, and the four-business-day disclosure clock is often the shortest of all.
• Financial services: banking and insurance regulators layer sector rules on top (state-level for many programs), and contractual notice clauses with customers and partners add a private layer that pays actual damages when missed.

Building the notification matrix

1. In hour one of discovery, capture the timestamp. Every clock keys off it.
2. Map the data: what data types were acquired, and by residency, whose? The data inventory in your response plan is what makes this an hour of work instead of a week.
3. Apply the strictest applicable deadlines per affected state, with the AG thresholds (250, 500) flagged for early notice decisions.
4. Document the risk-of-harm assessment where the statute allows deferral; undocumented assessments do not survive regulators.
5. Prepare content once: the statutory elements overlap heavily, so one master notice with state-specific addenda beats fifty bespoke letters.

Frequently asked questions

Is there a federal breach notification law in the US? For general consumer data, no single federal statute covers all breaches; state laws are the default layer, with federal regimes (HIPAA, GLBA for financial institutions, SEC rules for public companies) taking precedence in their sectors.

Which state has the shortest breach notification deadline? Several states set 30 days from discovery, including Colorado, Florida, Maine, North Dakota, and Washington; Texas uses 60 days for breaches affecting 250 or more residents. Most other states use the "without unreasonable delay" standard.

Do state breach laws apply if the data was encrypted? In most states, encrypted data is exempt when the encryption keys were not compromised, which is why encryption status is one of the first facts to establish in any incident scoping.

Do we notify the attorney general or the affected residents first? They are usually simultaneous duties; most states require resident notification without unreasonable delay and AG notice above a resident threshold. The matrix approach, strictest state first, keeps both on one calendar.