Handling a Data Breach Notification Obligation

Why this matters

When customer or employee data leaves the shop's control, a legal clock can start running whether or not anyone has noticed it yet. Every state, plus the District of Columbia and the U.S. territories, has a breach notification law, and they do not agree with each other: on what counts as personal information, on when notice is due, on who else must be told. A shop that waits to "see if anything comes of it" can miss a deadline it did not know it had, and a shop that sends a panicked notice on day two can tell 3,000 customers something that turns out to be wrong. This article takes the path from discovery to notice. It is not legal advice, and the step where you bring in a lawyer is marked; for a breach of any size, do not reach the notice stage without one.

What a notification law actually requires

The shape is similar across states, which is what lets you prepare before you have counsel on the phone. The details are what counsel is for.

• Personal information is usually defined as a person's first name or initial and last name combined with something sensitive: a Social Security number, a driver's license or state ID number, or a financial account or card number together with any code needed to use it. Many states add more (medical or health insurance information, biometric data, a username or email with its password). A customer list of names, addresses and phone numbers alone usually does not trigger notice; the same list with bank account numbers for autopay usually does.
• Encryption is usually a safe harbor. In most states, data that was encrypted and whose key was not also taken does not require notice. This is why an encrypted laptop is often a non-event and an unencrypted one is not.
• Some states let you skip notice after a documented finding of no likely harm; others do not. A number of states allow it, sometimes only after consulting law enforcement or documenting the reasoning; California, among others, has no general harm exception.
• The law that applies is the law of where each affected person lives, not where the shop is. A shop near a state line routinely has two or three states' laws in play at once.
• Deadlines differ and they gate on discovery or determination. Some states set a fixed number of days, commonly 30 to 60, counted from discovery or from determining a breach occurred: California (since January 1, 2026), Colorado, Florida and Washington set 30 days; Oregon sets 45; Texas sets 60 for notifying individuals. Others, including Idaho and many more, require notice in "the most expedient time possible and without unreasonable delay," which is not a license to wait and is often read as weeks, not months. Most allow a delay requested by law enforcement. These figures are current as of 2026 and states amend these laws often; re-check each state's current text through its attorney general's website or the National Conference of State Legislatures' list of state breach laws.
• Others may need to be told. Many states require notice to the state attorney general above a resident count (California and Washington, for example, above 500 residents), and many require notice to the consumer reporting agencies above a larger count. A few states, Connecticut among them, require offering identity protection services when Social Security numbers are exposed.
• The notice itself has content rules in some states. California, for example, requires a titled notice with set headings (Civil Code 1798.82). Counsel drafts to the strictest state in play.

At the federal level, there is no general breach notification law covering a typical residential service shop. What you will have instead are contracts: your card processor's agreement usually requires prompt notice of any suspected card-data compromise, and your cyber insurance policy requires prompt notice of a claim.

The path, step by step

The clock in each step is counted in calendar days from discovery, Day 0, because that is how most state deadlines are counted. Containment comes first and is its own procedure. See related: The First Hour After a Suspected Breach SOP.

1. Day 0: write down what you know and when you learned it. One page: what happened, when it was discovered, by whom, what data might be involved, what has been done. Why: "discovery" is the date many state clocks run from, and later you will need to show when it was. Skip it and the discovery date becomes a matter of memory, argued later.

2. Day 0 or 1: call the cyber insurer's claims line before you hire anyone. Most cyber policies require prompt notice and many require you to use the insurer's approved panel of breach lawyers and forensic firms; costs from vendors you chose yourself may not be covered. If you have no cyber policy, check whether your general liability or business owner's policy has a data breach endorsement. Skip it and you may pay for the whole response yourself on a policy that would have covered it.

3. Day 1 to 3: retain breach counsel, and route the investigation through them. This is the point past which you should not act on an article. A privacy or breach-response attorney decides which states' laws apply, whether each one is triggered, and what the notices say. Having counsel engage the forensic firm can also help keep the investigation's findings privileged; that is a question for counsel to structure, not you. Walk in with the Day 0 page, the list of what systems or files were involved, a customer and employee export showing what fields you hold, and your insurer's claim number.

4. Day 1 to 10: establish exactly what was exposed, and whose. The forensic firm, or for a simple physical loss, counsel working from your records, determines which files or systems were accessed and which data fields they held. Then count affected people by state of residence, using the billing or service address in your records. Skip it and you cannot know which laws apply or how many people a notice goes to.

5. Day 3 to 10: decide, state by state, whether notice is required. Counsel applies each state's definition, its encryption safe harbor and any harm exception to what was actually exposed. Some states require documenting a decision not to notify; keep that document. Skip it and you either notify people you did not need to, which costs trust and money, or skip a state where notice was due.

6. Same window: notify the card processor if any card data could be involved, and report to law enforcement. The processor's contract sets its own timeline, often short. A police report helps with the insurer and, if law enforcement asks you to delay notice for an investigation, that request usually pauses state clocks; get it in writing.

7. Before the earliest deadline: draft, approve, send. Counsel drafts the notice to satisfy the strictest state's content rules. You supply accurate facts, the call-in number and any service you are offering. Send to individuals, then to the attorneys general and consumer reporting agencies where required, in the order and form counsel specifies.

8. On sending: be ready for the calls. A short script for the office, a page on the website, and one named person who handles callbacks. Customers will ask whether to cancel cards, change bank accounts or freeze credit; the script says what the shop is offering and what counsel has approved saying, and nothing else.

Worked example: an unencrypted office laptop stolen from a car

A plumbing shop in Washington, a few miles from the Oregon and Idaho lines, runs autopay for maintenance-plan customers. On a Monday evening, the office manager's laptop is stolen from her car. Tuesday morning, she reports it. That is Day 0 for the shop's purposes, because that is when it was discovered.

Day 0. The office manager writes the one-page note. The laptop was password-protected but not encrypted. On its desktop is an export from last month: 3,400 maintenance-plan customers with name, service address, phone, and bank routing and account numbers for autopay. In a payroll folder are the shop's 14 employees' names and Social Security numbers. The shop calls the police and gets a report number.

Day 1. The owner calls the cyber insurer's claims line. The insurer assigns panel breach counsel and approves a small forensic engagement to confirm what the laptop held, working from the cloud backup of its files. The owner calls the bank about the autopay arrangement.

Day 4. The file review confirms the export and the payroll folder. Customers by state of residence:

Day 6. Counsel's determination. Name plus bank account number is personal information under all three states' laws as counsel reads them, and the laptop was not encrypted, so no safe harbor. Washington's 30 days from discovery is the earliest fixed deadline, and with 2,662 Washington residents the shop is over that state's threshold for notifying the attorney general. Oregon's 45 days follows. Idaho's "without unreasonable delay" standard is met by sending on the same date as the others. The clock chart counsel works to:

Day 0   discovered, police report, note written
Day 1   insurer notified, counsel assigned
Day 4   data and residents counted by state
Day 6   notice required in WA, OR, ID
Day 14  notices approved, call script ready
Day 16  mailed to all 3,414; WA AG notified
Day 30  WA deadline (met with 14 days spare)
Day 45  OR deadline

Day 16. Notices go to all 3,414 people at once, written to the strictest content rules in play. Customers are told their bank account numbers were exposed, advised to watch their accounts, and offered credit monitoring through the insurer's vendor. The shop also moves every affected autopay customer to new authorization once they have changed accounts. The Washington attorney general's office receives its notice the same day, and counsel handles the remaining regulator and credit-bureau notices as each state requires.

Why sending everyone on one date was right. Counsel could have staggered Oregon and Idaho later. A single mailing means one script, one set of calls and no customer learning from a neighbor across the state line that the shop knew a week earlier.

What would have changed the answer. If the laptop had full-disk encryption on and the key was not with it, most or all of the three states' safe harbors would likely have applied and the shop might have had no notice obligation at all, subject to counsel's reading of each state. If the export had held only names, addresses and phone numbers, it would probably not have been personal information under these three states' definitions, though a state that counts email plus password, or a broader definition, could still catch a different file. And if the shop had followed its own retention schedule, the payroll folder would not have been on the office manager's laptop in the first place. See related: Customer Data Retention: What to Keep and What to Destroy.

The failure mode. The common one is waiting. An owner who decides on Day 0 that a stolen laptop "probably just got wiped and sold" and does nothing for six weeks has missed Washington's 30 days and is now writing a notice that has to explain the delay to an attorney general.

Checking you did it right

• The Day 0 note exists, with the discovery date and who discovered it.
• The insurer was notified before any outside vendor was hired.
• Affected people were counted by state of residence, from records, not estimated.
• A determination exists for every state in play, including any decision not to notify, with counsel's reasoning.
• Every notice went out before its state's deadline, and the dates are recorded.
• The cause is fixed: encryption on every laptop, the export deleted, the retention schedule followed.

References

• National Conference of State Legislatures, list of state security breach notification laws (ncsl.org)
• California Civil Code 1798.82, notice content and timing for California residents
• See related: The First Hour After a Suspected Breach SOP
• See related: What Cyber Insurance Applications Actually Ask