State Data Breach Notification Requirements, Compared Across 48 States

Forty-Eight States Charted, and Why Not Fifty

All fifty states have a data breach notification statute. This guide charts forty-eight of them. California and Illinois are omitted from the tables, not because their statutes do not exist — California enacted the first breach notification law in the country and Illinois regulates the question through the Personal Information Protection Act — but because the research behind this site records those two states as curated pages that do not capture their breach deadlines and regulator thresholds against a primary source.

Stating that plainly is the alternative to filling the two rows from memory or from secondary summaries. A chart of this kind is only useful if every cell in it can be traced to the statute it describes, and two acknowledged gaps are less costly to a reader than fifty rows of which two are unsourced.

For the forty-eight that are charted, every cell below is taken from the statute or the regulator publication cited for that state in the source list at the foot of this guide.

The Deadline to Notify Affected Individuals

The single most searched question about these statutes is how long a notifier has, and the answer divides the country almost in half. Twenty-one states state a fixed outer limit in days. The remaining twenty-seven state only a reasonableness standard — some version of "in the most expedient time possible and without unreasonable delay" — with no number attached.

Among the states that do set a number, the clustering is tight. Five set 30 days: Florida, New York, Washington, Colorado and Maine. Eleven set 45: Oregon, Tennessee, Maryland, Indiana, Rhode Island, Alabama, Vermont, Arizona, New Mexico, Ohio and Wisconsin. Five set 60: Texas, Connecticut, Delaware, Louisiana and South Dakota.

The reasonableness states are not necessarily more permissive in practice. Several tie the clock to the conclusion of an investigation rather than to discovery — Utah, Nebraska, Idaho and Kansas each start from the point at which an investigation finds that misuse has occurred or is reasonably likely — which can run either shorter or longer than a fixed window depending on how quickly the scope of an incident resolves.

Two states set numbers that apply to public rather than private entities. Pennsylvania gives a State agency seven business days and a county, public school or municipality three business days to notify the district attorney. Rhode Island sets 45 calendar days for private entities and 30 for state and municipal agencies.

Notice to the Attorney General or State Regulator

The second axis is who else has to be told, and at what point. This is where the statutes diverge most sharply, and where a process built to one state's rule is most likely to miss another's.

The Four Threshold Patterns

Across the forty-eight states, regulator notice falls into four patterns.

• Every breach, no headcount (13 states). New York, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Maryland, Indiana, Massachusetts, North Carolina, Maine, Vermont and Louisiana require notice to a state body whenever consumer notice is triggered, regardless of how many residents are affected.
• A numeric threshold (20 states). Texas, Oregon, North Dakota and South Dakota set it at 250 residents. Florida, Washington, Colorado, Delaware, Iowa, Utah, Rhode Island and Pennsylvania set it at 500. Virginia, Alabama, Arizona, Arkansas, Hawaii, South Carolina, Missouri and New Mexico set it at 1,000.
• No state-agency notice duty (13 states). Wyoming, Tennessee, Kentucky, Oklahoma, Nevada, Minnesota, Kansas, Michigan, Ohio, West Virginia, Wisconsin, Georgia and Mississippi impose no general duty to report a breach to the attorney general. Several of these still require notice to the nationwide consumer reporting agencies above a threshold.
• Conditional (2 states). Alaska and Idaho each make regulator notice depend on something other than a headcount.

The absence of a reporting duty is not the same as the absence of enforcement authority. Wyoming states no attorney general notification requirement for private businesses while preserving the Attorney General's power to bring an action for any violation, and Oklahoma places its office's role under 24 O.S. section 165 in enforcement rather than in receipt of notice.

The States That Invert or Accelerate the Clock

Five states depart from the ordinary sequence in ways a process built to the common pattern would not anticipate.

Alaska inverts the trigger. Written notice goes to the Attorney General where the covered person decides not to disclose, after concluding that harm is not reasonably likely — so the filing obligation attaches to the decision to stay silent rather than to the decision to notify. The 1,000-person figure in Alaska triggers notice to the nationwide consumer credit reporting agencies instead.

Maryland and Massachusetts reverse the ordering. Both require notice to the state before notice to residents, for any breach and with no numeric threshold, which means the regulator learns of an incident first as a matter of statute rather than as a matter of practice.

Three states run a separate, shorter clock for the regulator filing than for consumer notice. Iowa requires written notice to the director of the consumer protection division within five business days after notice is given to any consumer. Vermont requires a preliminary description of the breach within fourteen business days of discovery or of consumer notice, whichever is sooner. Louisiana, under LAC 16:III.701, treats notice to the Attorney General's Consumer Protection Section as timely if received within ten days of distribution of notice to Louisiana citizens, and requires it to include the names of all affected citizens.

Idaho splits by sector rather than by size: a public agency notifies the Attorney General within twenty-four hours of discovery, while a commercial entity may notify but is not required to. Minnesota runs its own short clock for a different recipient, requiring notice to the nationwide consumer reporting agencies within forty-eight hours above 500 persons.

Substitute Notice, Encryption and Consumer Reporting Agencies

Three further mechanisms recur across these statutes, and the research behind this site documents each of them for some but not all of the forty-eight states. The counts below state the coverage rather than implying the mechanism is absent elsewhere.

Substitute notice — permission to give notice by email, website posting and statewide media where direct notice would be disproportionately costly or the contact information is unavailable — is documented for twenty-six of the forty-eight. Encryption safe harbours, under which the acquisition of encrypted data does not trigger the notification duty unless the key was also acquired, are documented for nineteen. Notice to the nationwide consumer reporting agencies, generally at a 1,000-person threshold, is documented for twenty.

For the states not counted, no claim is made here either way. The state pages linked in the sources set out what each statute provides on its own terms.

Where the Record Is Incomplete

Three gaps in this chart are worth naming rather than leaving for a reader to discover.

California and Illinois are absent from both tables, for the reason given at the top of this guide. Mississippi appears in the tables but its deadline cell does not state a deadline: the research found that the Attorney General's Consumer Protection Division identifies the state breach notification statute among the laws it enforces civilly, without publishing an individual-notice deadline the way other states do. The one Mississippi breach-reporting deadline published by a state agency belongs to the insurance sector, where the Insurance Data Security Law requires a licensee to notify the Commissioner no later than three business days after determining that a cybersecurity event involving nonpublic information has occurred.

Recording those three as gaps rather than approximating them is the same standard applied throughout this site: a claim that cannot be traced to a primary source in this guide is labelled as such, not presented as though it were sourced.

Sectoral Federal Overlays

State breach statutes do not operate alone. The HHS breach notification rule at 45 C.F.R. part 164 subpart D governs protected health information in the hands of covered entities and business associates; the Gramm-Leach-Bliley Act safeguards framework governs customer information at financial institutions; and sector regulators impose their own filings, as the Mississippi insurance example above shows.

Several state statutes address the overlap directly rather than leaving it to be worked out. West Virginia excepts entities subject to the Gramm-Leach-Bliley Act from its consumer reporting agency notice duty. New Hampshire routes regulated businesses to their primary regulator instead of the Attorney General. Maine directs notice to the appropriate regulators within the Department of Professional and Financial Regulation, reaching the Attorney General only where the person is not regulated by that department. Vermont substitutes the Department of Financial Regulation for the Attorney General for the entities it regulates.

Frequently Asked Questions