Data Breach Notification Laws: A Guide for Small Businesses

Every US state has a law that says what a business must do when personal information is exposed. The rules are similar in spirit but differ on the details that matter most in the first weeks after an incident: who counts as affected, how fast you must tell them and when the state attorney general has to hear about it. This guide explains the basics in plain language. It is general information, not legal advice, so involve your attorney as soon as you suspect a breach.

The short answer

When a breach exposes personal information, you usually have to notify each affected person, and often a state regulator, within a deadline set by the state where that person lives. Deadlines run from 30 to 60 days in many states, while others use “the most expedient time possible and without unreasonable delay”. Data that was encrypted, with the key kept safe, is usually exempt.

Which state’s law applies

This is the part that surprises most business owners. The law that applies is not the one where your office is. It is the law of the state where each affected person lives.

A Dallas accounting firm with clients who retired to Florida and Arizona follows Texas law for its Texas clients, Florida law for the Florida clients and Arizona law for the Arizona clients. A national nonprofit with donors in every state may owe notices under dozens of laws at once. In practice, many businesses send one notice that meets the strictest deadline and content rules that apply, then add any state-specific wording their attorney recommends.

What counts as personal information

State laws focus on information that can be used for identity theft or fraud. The core definition is usually a person’s name combined with one of these:

• Social Security number.
• Driver’s license or state ID number.
• A financial account or card number together with the code or password that unlocks it.

Many states go further and include medical and health insurance information, passport numbers, taxpayer ID numbers, biometric data such as fingerprints and face scans, and a username or email address together with its password. That last item matters for small businesses, because a hacked Microsoft 365 mailbox can expose both the account itself and everything that was stored in it.

Deadlines in the states we serve

The table below summarizes the notice rules for the ten states where our cities are. Laws change, so check the current statute or ask your attorney before relying on a deadline.

Two states deserve a note. Georgia’s statute, O.C.G.A. 10-1-912, is narrower than most and does not reach the typical private business, though Georgia companies still owe notice under other states’ laws and federal rules. Illinois also has the Biometric Information Privacy Act, which sets strict rules for collecting fingerprints and face scans, so a manufacturer with biometric time clocks has more to think about than notice deadlines.

Most states let you delay notice when law enforcement asks you to, so the investigation is not compromised. Get that request in writing.

Federal rules on top of state law

Some industries have a federal rule that adds its own deadline, and you follow both.

• HIPAA. Medical and dental practices, and the vendors that handle patient data for them, must notify affected patients without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people are reported to HHS within the same window, and to prominent media outlets when more than 500 residents of one state are affected. Smaller breaches are logged and reported to HHS each year.
• The FTC Safeguards Rule. Non-bank financial businesses, including tax preparers, CPA firms, mortgage brokers and auto dealers, must notify the FTC no later than 30 days after discovering that unencrypted information about 500 or more customers was taken. The IRS also asks tax professionals to report data theft to their IRS Stakeholder Liaison.
• SEC Regulation S-P. Broker-dealers and SEC-registered investment advisers must keep an incident response program and notify affected clients no later than 30 days after learning that sensitive customer information was accessed or used without authorization.
• DFARS 252.204-7012. Defense suppliers that handle controlled unclassified information must report cyber incidents to the Department of Defense within three days of discovery, preserve images of affected systems and share them if asked.
• Law firms. ABA Formal Opinion 483 says lawyers should tell current clients when a breach exposes their information, on top of any state notice law.

Encryption and other safe harbors

Almost every state exempts data that was encrypted, as long as the encryption key was not taken along with it. That makes encryption the single most useful control for limiting the damage of a lost laptop or a stolen backup drive. Full-disk encryption on every workstation, encrypted backups and encrypted storage for files that hold Social Security or account numbers can turn a reportable breach into a non-event.

Many states also let you skip notice if, after a reasonable investigation, you conclude the exposure is unlikely to cause harm. That conclusion usually has to be documented and sometimes shared with the attorney general, so it is a decision for your attorney, not a shortcut.

What to do in the first days

The first days after a suspected breach set the tone for everything that follows. A simple order of operations helps.

1. Contain it. Reset passwords on affected accounts, end active sign-in sessions, disconnect infected computers from the network and stop any mailbox rules that forward mail outside the company.
2. Preserve the evidence. Do not wipe or rebuild machines until your insurer or investigator agrees. Sign-in logs, mailbox audit logs and firewall logs show what was reached and when.
3. Call your cyber insurer. Most policies require prompt notice and give you a breach coach, usually an attorney, plus forensic investigators. Using people outside the insurer’s panel can affect coverage.
4. Call your attorney. Work done under the direction of counsel can be privileged, and your attorney decides which laws apply and what the notices say.
5. Work out who is affected. List the people whose information was on the affected systems and the states where they live. That list drives every deadline above.
6. Notify on time. Send notices to people, regulators and credit reporting agencies as each law requires, and keep copies of everything you sent.

How good IT makes a breach smaller

You cannot choose the deadlines, but you can make it far less likely that you ever need them, and much easier to answer the hard questions if you do.

• Encryption on every laptop, workstation, server and backup, so a lost device is not a breach.
• Multi-factor authentication on email, remote access and admin accounts, which blocks most account takeovers.
• Logging and monitoring of sign-ins and mailbox changes, kept long enough to show investigators what happened.
• Knowing where personal data lives, so you can scope an incident quickly instead of assuming the worst.
• Tested backups kept separate from your network, so ransomware is an outage to recover from rather than a ransom to pay.
• A written incident response plan with your insurer’s and attorney’s phone numbers in it, so nobody is searching for them on the worst day.

We help clients put these controls in place and document them as part of IT compliance support and cybersecurity. When something does go wrong, we gather the technical facts your attorney and insurer need: which accounts were used, which systems were reached and what data sat on them. If an email account is the starting point, our guide to business email compromise warning signs walks through the first steps.