If you were breached tomorrow: who do you have to tell, and by when?
Every US state has a data-breach notification law, and each one protects its own residents — wherever your business is. So the clock that applies is set by where the affected people live. Pick those states to see each deadline, who else must be told, and the tightest clock you're running.
Summarized from the Privacy Rights Clearinghouse, Data Breach Notification Laws: A 50-State Survey (2026 Edition), published January 28, 2026. Checked October 7, 2026. Not legal advice.
Where do the affected people live?
Tick every state. Your own state first, then your customers'.
Clocks that run alongside the state's
FTC Safeguards Rule — financial-service firms
Tax preparers, auto dealers that finance, mortgage brokers and other non-bank financial institutions must tell the FTC within 30 days of discovering a security event involving the unencrypted information of 500 or more consumers.
HIPAA — anyone handling patient information
Covered entities notify affected individuals without unreasonable delay and within 60 calendar days of discovery, and report to HHS — business associates notify the covered entity. It runs alongside the state law, not instead of it.
Your contracts, and your insurer
Card brands (through your payment provider), larger customers and most cyber policies set their own, often much shorter, notice windows — sometimes 24 to 72 hours. Call your insurer's breach hotline first: they usually provide the breach lawyer who works out which clocks apply.
All 50 states and DC
The best breach notice is the one you never send.
Encrypted laptops and an incident plan are on the free security baseline check — and encryption is what most state laws exempt from notice altogether.
Check your security baseline→A plain-English summary to help you act quickly — not legal advice. It covers state breach-notification statutes for businesses: regulations, sector rules and recent amendments can add duties, and whether an incident is a notifiable "breach" at all depends on each state's definitions (many exempt encrypted data, and some only require notice if harm is likely). After a real incident, get a breach lawyer — usually through your cyber insurer.