RESOURCES

Data Breach Requirements

There are both State and Federal regulatory schemes that deal with data breaches and notification of those whose personally identifiable information may have been compromised.  We are able to provide the resources that allow the identification of the individuals who need to be notified of a breach.  We generally perform these services in conjunction with forensic experts who obtain the data that needs to be reviewed, cyber security experts and lawyers who specialize in data breach matters.

The sources of federal law that most frequently come into play are in the medical information area, HIPPA regulations (45 CFR Parts 160 and 164) and in the financial services area, the Gramm-Leach-Bliley Act (15 USC Sec 6801 et. seq.) and the regulations issued thereunder.

Notification of a breach is required pursuant to HIPPA without unreasonable delay and in no case later than 60 days following the discovery of a breach. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

Notification of a breach is required pursuant to the Gramm-Leach-Bliley Act to “the affected customer as soon as possible.”

Each state has its own regulatory scheme that must be followed in conjunction with breaches of the data of its citizens. It is wise to read the statutes together and comply with the most aggressive timeline of notification.  Click on the State you are interested in and you will find a link to the State Law provisions regarding data breach.

newusa ( copy) Placeholder
newusa ( copy)

State Statute Notification Requirements

Alabama

Alabama

Timeline for Notification

within 45 days of the covered entity’s receipt of notice

Statute

Ala. Code § 8-38-5 (b)

Alaska

Alaska

Timeline for Notification

in the most expeditious time possible and without unreasonable delay

Statute

Alaska Stat. § 45.48.010 (b)

 

Arizona

Arizona

Timeline for Notification

within 45 days after a determination that a breach has occurred

Statute

Ariz. Rev. Stat. § 18-552 (B)

 

Arkansas

Arkansas

Timeline for Notification

in the most expedient time and manner possible and without unreasonable delay

Statute

Ark. Code § 4-110-101 (a) (2)

 

California

California

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

CA Civ Code § 1798.82 (a)

Colorado

Colorado

Timeline for Notification

in the most expedient time possible and without unreasonable delay, but not later than thirty days

Statute

Colo. Rev. Stat. § 6-1-716 (2)

 

Connecticut

Connecticut

Timeline for Notification

without unreasonable delay but not later than ninety days

Statute

Conn. Gen. Stat. § 36a-701b (b)(1)

 

Delaware

Delaware

Timeline for Notification

without unreasonable delay but not later than 60 days

Statute

Del. Code Ann. tit. 6 § 12B-102 (c)

 

District of Columbia

District of Columbia

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

D.C. Code § 28-3852 (a)

Florida

Florida

Timeline for Notification

as expeditiously as practicable, but no later than 30 days

Statute

FL Stat § 501.171 (4)(a)

 

Georgia

Georgia

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

Ga. Code § 10-1-912 (a)

 

Hawaii

Hawaii

Timeline for Notification

without unreasonable delay

Statute

Haw. Rev. Stat § 487N-2 (a)

 

Idaho

Idaho

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

Idaho Code § 28-51-105 (1)

Illinois

Illinois

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

815 ILCS 530/10 (a)

 

Indiana

Indiana

Timeline for Notification

without unreasonable delay

Statute

Ind. Code § 24-4.9-3-3 (a)

 

Iowa

Iowa

Timeline for Notification

in the most expeditious manner possible and without unreasonable delay

Statute

IA Code § 715C.2 (1)

 

Kansas

Kansas

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

Kan. Stat. § 50-7a02 (a)

Kentucky

Kentucky

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

Ky. Rev. Stat. § 365.732 (2)

 

Louisiana

Louisiana

Timeline for Notification

in the most expedient time possible and without unreasonable delay, but not later than 60 days

Statute

La. Rev. Stat. § 51:3074 (E)

 

Maine

Maine

Timeline for Notification

as expediently as possible and without unreasonable delay

Statute

10 Me. Rev. Stat. § 1348 (1) (A)

 

Maryland

Maryland

Timeline for Notification

as reasonably practicable, but not later than 45 days

Statute

Md. Code Com. Law § 14Đ3504 (b) (3)

Massachusetts

Massachusetts

Timeline for Notification

as soon as practicable and without unreasonable delay

Statute

Mass. Gen. Laws 93H § 3 (a)

 

Michigan

Michigan

Timeline for Notification

without unreasonable delay

Statute

Mich. Comp. Laws § Section 445.72 Sec 12 (4)

 

Minnesota

Minnesota

Timeline for Notification

most expedient time possible and without unreasonable dela

Statute

Minn. Stat. 325E.61 § Subd. 1 (a)

 

Mississippi

Mississippi

Timeline for Notification

without unreasonable delay

Statute

Miss. Code § 75-24-29 (3)

Missouri

Missouri

Timeline for Notification

without unreasonable delay

Statute

Mo. Rev. Stat. § 407.1500 (2) (1)

 

Montana

Montana

Timeline for Notification

without unreasonable delay

Statute

Mont. Code V 30-14-1704 (1)

Nebraska

Nebraska

Timeline for Notification

as soon as possible and without unreasonable delay

Statute

Neb. Rev. Stat. § 87-803 (1)

 

Nevada

Nevada

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

NRS_603A.220 (1)

 

New Hampshire

New Hampshire

Timeline for Notification

as soon as possible

Statute

NH Rev Stat § 359-C:20 (I) (a)

New Hampshire

New Hampshire

Timeline for Notification

promptly notify in writing

Statute

NH Rev Stat § 332-I:5

New Jersey

New Jersey

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

N.J. Stat. § 56:8-163 (12) (a)

New Mexico

New Mexico

Timeline for Notification

in the most expedient time possible, but not later than 45 days

Statute

NM Stat § 57-12C-6 (A)

 

New York

New York

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

N.Y. Gen. Bus. Law § 899-aa (2)

North Carolina

North Carolina

Timeline for Notification

without unreasonable delay

Statute

N.C. Gen. Stat. § 75-65 (a)

North Dakota

North Dakota

Timeline for Notification

in the most expedient time possible and without unreasonable delay

Statute

N.D. Cent. Code § 51-30-02

Ohio

Ohio

Timeline for Notification

in the most expedient time possible but not later than forty-five days

Statute

Ohio Rev Code § 1349.19 (B) (2)

 

Oklahoma

Oklahoma

Timeline for Notification

without unreasonable delay

Statute

OK Stat § 24-163 (A)

Oregon

Oregon

Timeline for Notification

in the most expeditious manner possible, without unreasonable delay, consistent without unreasonable delay

Statute

Or. Rev. Stat. § § 646A.604 (1) (a)

Pennsylvania

Pennsylvania

Timeline for Notification

without unreasonable delay

Statute

73 Pa. Stat. § 2303 (a)

Rhode Island

Rhode Island

Timeline for Notification

in the most expedient time possible but no later than forty-five (45) calendar days

Statute

R.I. Gen. Laws § 11-49.3-4 (a) (2)

 

South Carolina

South Carolina

Timeline for Notification

without unreasonable delay

Statute

S.C. Code Ann. § 39-1-90 (A)

South Dakota

South Dakota

Timeline for Notification

within 60 days

Statute

SDCL § 22-40-20

Tennessee

Tennessee

Timeline for Notification

immediately, but no later than forty-five (45) days

Statute

Tenn. Code Ann. § 47-18-2107 (d)

Texas

Texas

Timeline for Notification

as quickly as possible

Statute

Tex. Bus. & Com. Code § Sec. 521.053 (b)

 

Utah

Utah

Timeline for Notification

in the most expedient time possible without unreasonable delay

Statute

Utah Code  § 13-44-202 (2)

Vermont

Vermont

Timeline for Notification

in the most expedient time possible and without unreasonable delay, but not later than 45 days

Statute

9 V.S.A. § 2435 (b) (1)