Breach Notification Laws in All 50 States

Lesson 01 defined the words. This lesson walks through the statutes themselves, state by state. Lesson 10 takes Idaho's law apart line by line, and course 73's lesson on state privacy and breach laws covers the same ground from a manager's chair, with a compliance calendar. Here the reader is a resident who got a letter, an advocate tracking a hack at a school district, or a candidate whose campaign database just leaked.

Every state has one

California's breach law, now Civil Code 1798.82, is the model most states copied, down to the name-plus-data-element definition. Idaho's arrived in 2006 (the history note on 28-51-104 reads "added 2006, ch. 258"). The last two states to pass one did so in 2018: South Dakota (its 22-40-20 carries the history note SL 2018, ch 135) and Alabama (the Alabama Data Breach Notification Act of 2018, Act 2018-396, at Code 8-38-1 and following). The National Conference of State Legislatures counts all 50 states, D.C., Guam, Puerto Rico and the Virgin Islands as having laws that require private businesses, and in most states government agencies, to notify people when their personal information is breached.

There is no federal breach law for ordinary businesses. Congress has passed rules for health data, financial institutions, public companies and phone carriers, covered below, but a hardware store, a church or a campaign answers to state law alone.

The single most useful fact about these laws: they protect residents, not companies. Idaho's statute speaks of "personal information about a resident of Idaho." Washington's speaks of Washington residents. So a business in Boise that loses data on 40 Idahoans and 12 Oregonians owes the Idahoans Idaho's process and the Oregonians Oregon's, which includes a 45-day deadline and, above 250 people, a filing with the Oregon Attorney General. A large breach that touches every state means 50-plus sets of rules at once. That is why national companies plan around the strictest one.

The parts every law has

1. A list of covered data

Every breach law starts with a definition of personal information. The original California model, still Idaho's model, is a person's first name or first initial and last name plus one of a short list of data elements: a Social Security number; a driver's license or state ID number; or a financial account, credit or debit card number together with the code or password needed to use it. Idaho Code 28-51-104(5) stops there.

Most states have moved past that list. Colorado's 6-1-716 adds passport numbers, medical information, health insurance identification numbers, biometric data, and a username or email address with the password that opens an online account. California's 1798.82(h) adds medical and health insurance information, biometric data, data from automated license plate reader systems, genetic data, and the same online credential category, which needs no name at all. When a letter says "personal information was not involved," the first question is always: under which state's list?

2. A definition of breach

Most laws define a breach as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information. Idaho's version says "illegal acquisition of unencrypted computerized data that materially compromises" that security. A few states and the HIPAA rule look at unauthorized access or use rather than acquisition, which reaches cases where an intruder could read a file but left no proof of copying it. Almost every law excludes good-faith acquisition by an employee or agent for the organization's own purposes, so long as the data is not misused or disclosed further.

Most statutes reach only computerized data. Idaho's covers computerized data only, so a box of paper applications left in a dumpster falls outside 28-51-105, even if it would be news.

3. A harm test, in many states

Many laws let an organization skip notice if a documented investigation finds that misuse is not reasonably likely. Idaho builds the test into the duty itself: an entity must "conduct in good faith a reasonable and prompt investigation" and notify if misuse "has occurred or is reasonably likely to occur." Some states require the no-harm finding to be shared. Alaska's AS 45.48.010 allows the no-notice decision only after written notification to the Alaska Attorney General, and the determination must be kept for five years. South Dakota's law allows it only after notice to its attorney general. Florida requires the written determination to be kept for at least five years and sent to its Department of Legal Affairs within 30 days. Mississippi excuses notice if the breach "will not likely result in harm."

Other states have no harm test, or a narrow one, so acquisition alone triggers letters. The practical gap is large: the same incident can produce letters in one state and a memo in a file drawer in the next.

4. The encryption safe harbor and the key exception

Nearly every state exempts encrypted data. The exemption has a catch that matters in real cases: if the thief also got the key, the data was never really protected. Texas writes it into Business and Commerce Code 521.053(a): a breach includes encrypted data if the person accessing it has the key. Idaho's definition covers personal information "when either the name or the data elements are not encrypted," so an encrypted Social Security number paired with a plain-text name is still covered. A failed 2025 Idaho bill would have defined encryption to include tokenization; that story is in lesson 10.

5. A clock

Two styles. Standard-based laws, Idaho's among them, require notice "in the most expedient time possible and without unreasonable delay," consistent with law enforcement needs and the time needed to find the scope of the breach and restore the system. Fixed-deadline laws add an outer limit counted in days. Both kinds allow a delay when a law enforcement agency says notice would impede a criminal investigation. Some states want that request on paper: Oregon allows the delay only if the law enforcement agency requests it in writing.

The clock usually starts at discovery or at the determination that a breach occurred, not at the date of the intrusion. Hackers often sit inside a network for weeks before anyone notices, so the gap between intrusion and letter can be months even when every deadline is met.

6. Notice to regulators and credit bureaus

Many states require a copy or a report to the attorney general (or a consumer protection office or state police) once a breach affects a set number of residents: 50 in D.C., 250 in Oregon, South Dakota, North Dakota and Texas, 500 in California, Colorado, Florida, Illinois, Iowa, Rhode Island, Utah, Delaware, Washington, Pennsylvania (more than 500, at the same time residents are told, since a 2024 amendment) and Oklahoma (500 or more, within 60 days after residents are told, since January 1, 2026), 1,000 in Arizona, Arkansas and Missouri. Some require it for any breach (Connecticut, Maryland, Massachusetts, Nebraska, New Hampshire, New York, North Carolina, Vermont, Virginia). New Jersey is unusual: a business must report to the Division of State Police before it notifies customers.

Separately, most states require notice to the nationwide consumer reporting agencies (Equifax, Experian and TransUnion) when a breach crosses a larger line, commonly 1,000 residents. Minnesota's threshold is 500 and its deadline is 48 hours. Pennsylvania's is also more than 500. New York's is 5,000. Georgia's and Texas's are 10,000. The point of that notice is practical: the bureaus brace for a wave of freeze and fraud alert requests.

7. What the letter must say

Older laws say little about content. Newer ones prescribe it. California requires the title "Notice of Data Breach" and the headings "What Happened?", "What Information Was Involved?", "What We Are Doing", "What You Can Do" and "For More Information." Oregon's 646A.604(5) requires a general description, the approximate date, the type of information, contact information for the company and the credit bureaus, and advice to report suspected identity theft to law enforcement, including the Attorney General and the FTC. Maryland and Arizona require the toll-free numbers and websites for the FTC.

8. Substitute notice

When mailing would cost too much or reach too many people, or contact information is missing, the laws allow substitute notice: email where available, a conspicuous website posting, and notice to major statewide media. Idaho sets the lines at $25,000 in cost or 50,000 Idaho residents. Oregon sets them at $250,000 or 350,000 consumers. New Mexico uses $100,000 or 50,000 residents. A newsroom that gets a breach press release from an out-of-state company may be receiving the substitute notice itself.

9. Owners notify; vendors tell owners

The organization that owns or licenses the data sends the letters. A vendor that only stores or processes the data must tell the owner. Idaho says "immediately following discovery" if misuse occurred or is reasonably likely. Oregon gives vendors 10 days and makes a vendor notify the Attorney General itself if more than 250 consumers are involved and the owner has not reported. Georgia gives a vendor 24 hours. This is why a school district can end up sending letters about a breach that happened at its software provider, and why the vendor contract decides who pays.

10. Remedies

Enforcement is mostly by the attorney general, often by declaring a violation an unfair or deceptive practice under the state's consumer protection act (Connecticut, Illinois and North Carolina do this). Penalties vary. Idaho: a fine of not more than $25,000 per breach for an entity that intentionally fails to give notice, under 28-51-107. Virginia: a civil penalty of up to $150,000 per breach or series of similar breaches found in one investigation. New York: for knowing or reckless violations, the greater of $5,000 or up to $20 per failed notification, capped at $250,000.

A handful of breach statutes let injured people sue. Washington's 19.255.040 says any consumer injured by a violation "may institute a civil action to recover damages." Tennessee and South Carolina have similar language. North Carolina bars individual suits unless the person was injured. Florida says its section "does not establish a private cause of action," and Mississippi says nothing in its section creates one. Virginia's law says nothing in it limits an individual from recovering direct economic damages.

California has the sharpest tool, and it sits outside the notice statute. Civil Code 1798.150, part of the CCPA, lets a consumer sue when nonencrypted and nonredacted personal information is stolen or disclosed because a business failed to maintain reasonable security. Statutory damages run from $100 to $750 per consumer per incident, or actual damages if greater. Before suing for statutory damages, the consumer must give 30 days' written notice, and a business that actually cures the violation avoids statutory damages claims; adding security after the fact does not count as a cure. The California Privacy Protection Agency adjusts CCPA dollar amounts for inflation under Civil Code 1798.199.95, so the current figures may run higher than the statute text.

Where the deadlines sit

Outer deadline to notify residents	Jurisdictions (checked on statute text, October 2026)
30 days	California (30 calendar days, since January 1, 2026), Colorado, Florida (15 more days for good cause shown to the state), Maine, New York, Washington (30 calendar days)
45 days	Alabama, Arizona, Indiana, Maryland, New Mexico (45 calendar days), Ohio, Oregon, Rhode Island (45 calendar days for businesses, 30 for state and municipal agencies), Tennessee, Vermont, Wisconsin
60 days	Connecticut, Delaware, Louisiana, South Dakota, Texas
No fixed count ("without unreasonable delay" or similar)	Alaska, Arkansas, D.C., Georgia, Hawaii, Idaho, Illinois, Iowa, Kansas, Kentucky, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania (private entities; state agencies, counties, public schools and municipalities have 7 business days), South Carolina, Utah, Virginia, West Virginia, Wyoming; Puerto Rico ("as expeditiously as possible," but 10 days to the Department of Consumer Affairs, per a law firm chart)
Not checked this session	Guam, U.S. Virgin Islands

Two notes on reading that table. A fixed deadline is a ceiling, not a target: every one of those laws also says notice must be made without unreasonable delay. And states keep amending. California moved from "most expedient time possible" to 30 calendar days with SB 446 in 2025, effective January 1, 2026. Check the statute text before relying on any chart, this one included.

All 50 states and D.C.

The table below was built from the statute texts on official legislature sites where they would load, and from the 2025 state codes posted by Justia where they would not, all read in October 2026. NCSL's list (its summary page says it was updated January 17, 2022, so newer amendments are not reflected there) supplied the citations. A fact check on October 26, 2026 re-read 23 rows (Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Iowa, Maine, Maryland, Minnesota, New York, North Carolina, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Dakota, Texas, Vermont, Virginia and Washington) on the statute text or an official state page. "AG" means the attorney general or the office the statute names. "CRA" means the nationwide consumer reporting agencies. "Not checked" means this lesson did not confirm the item on the text; read the statute before relying on a blank. "Suit in statute" covers only language in the breach statute itself; many states' general consumer protection acts allow private suits for unfair practices, which is a separate question.

State	Citation	Fixed deadline	Regulator notice	CRA notice	Suit in statute
Alabama	Code 8-38-1 et seq.	45 days	Not checked	Not checked	Not checked
Alaska	AS 45.48.010 et seq.	None	AG in writing before skipping notice on a no-harm finding	Not checked	Not checked
Arizona	ARS 18-551, 18-552	45 days	AG and state Department of Homeland Security, over 1,000	Over 1,000	Not checked
Arkansas	Code 4-110-101 et seq.	None	AG, over 1,000 (at notice or within 45 days)	Not checked	Not checked
California	Civ. Code 1798.82; 1798.29 (agencies)	30 calendar days	AG sample notice, over 500, within 15 days of notifying	Not checked	Yes, separately: 1798.150
Colorado	CRS 6-1-716	30 days	AG, 500 or more, within 30 days	Over 1,000	None in section; AG enforces
Connecticut	CGS 36a-701b	60 days	AG, any breach, by the time residents are notified	Not checked	Through unfair trade practice law; AG enforces
Delaware	6 Del. C. 12B-101 et seq.	60 days	AG, over 500	Not checked	Not checked
D.C.	Code 28-3851 et seq.	None	AG, 50 or more	Over 1,000	Not checked
Florida	Stat. 501.171	30 days (+15 for good cause)	Dept. of Legal Affairs, 500 or more, within 30 days	Over 1,000	No, stated
Georgia	Code 10-1-910 to 912	None	None in statute	Over 10,000	Not checked
Hawaii	HRS 487N-1 et seq.	None	Office of Consumer Protection, over 1,000	Over 1,000	Not checked
Idaho	Code 28-51-104 to 107	None	AG within 24 hours, public agencies only	None in statute	None in statute; regulator enforces
Illinois	815 ILCS 530	None	AG, over 500, no later than consumer notice	Not checked	Through the Consumer Fraud Act
Indiana	Code 24-4.9	45 days	Not checked	Not checked	Not checked
Iowa	Code 715C.1, 715C.2	None	AG, over 500, within 5 business days after notifying consumers	Not checked	Not checked
Kansas	KSA 50-7a01 et seq.	None	None found	Over 1,000	Not checked
Kentucky	KRS 365.732	None	None in statute	Over 1,000	Not checked
Louisiana	RS 51:3071 et seq.	60 days	AG gets written reasons for any delay; written no-harm findings on request within 30 days	Not checked	Not checked
Maine	10 MRSA 1346 et seq.	30 days	State regulator or AG, any breach	Over 1,000	Not checked
Maryland	Com. Law 14-3504	45 days	AG, any breach, before residents	Not checked	Not checked
Massachusetts	MGL 93H, section 3	None	AG and Office of Consumer Affairs and Business Regulation, any breach	As the state office directs	Not checked
Michigan	MCL 445.72	None	Not checked	Not checked	Not checked
Minnesota	Stat. 325E.61	None	None found; AG enforces	Over 500, within 48 hours	Not checked
Mississippi	Code 75-24-29	None	None in statute	Not checked	No, stated
Missouri	RSMo 407.1500	None	AG, over 1,000	Over 1,000	Not checked
Montana	MCA 30-14-1704	None	AG consumer protection office gets a copy	Coordinate if notice points to a bureau	Not checked
Nebraska	Rev. Stat. 87-801 et seq.	None	AG, any breach, by the time residents are notified	Not checked	Not checked
Nevada	NRS 603A.220	None	None found; AG or district attorney may seek injunction	Over 1,000	Not checked
New Hampshire	RSA 359-C:19 to 21	None	AG or primary regulator, any breach	Over 1,000	Not checked
New Jersey	Stat. 56:8-161, 163	None	Division of State Police, before customers	Over 1,000	Not checked
New Mexico	Stat. 57-12C-1 et seq.	45 calendar days	Not checked	Not checked	Not checked
New York	Gen. Bus. Law 899-aa	30 days	AG, Department of State, State Police, any breach (plus DFS for its covered entities)	Over 5,000	Not checked; AG penalties
North Carolina	GS 75-61, 75-65	None	AG Consumer Protection Division, any breach	Over 1,000	Only if injured
North Dakota	Cent. Code 51-30	None	AG, over 250	Not checked	Not checked
Ohio	Rev. Code 1349.19	45 days	None found	Over 1,000	Not checked
Oklahoma	24 O.S. 161 to 166, as amended by SB 626 (2025), effective January 1, 2026	None	AG, 500 or more (1,000 for a credit bureau's own breach), within 60 days after notifying residents	Not checked	No; AG or district attorney has exclusive authority
Oregon	ORS 646A.600 to 628	45 days	AG, over 250 (vendors too)	Over 1,000	Not checked
Pennsylvania	73 P.S. 2301 et seq., amended 2024 (effective September 26, 2024)	None for private entities; 7 business days for state agencies, counties, public schools and municipalities	AG, more than 500, at the same time as residents	More than 500	AG enforces under the unfair trade practices law
Rhode Island	Gen. Laws 11-49.3-4	45 calendar days (agencies 30)	AG, over 500	Over 500	Not checked
South Carolina	Code 39-1-90	None	Dept. of Consumer Affairs, over 1,000	Over 1,000	Yes
South Dakota	Cod. Laws 22-40-19 to 26	60 days	AG, over 250	Not checked	Not checked
Tennessee	Code 47-18-2107	45 days	None in statute	Over 1,000	Yes
Texas	Bus. and Com. Code 521.053	60 days	AG, 250 or more, within 30 days	Over 10,000	Not checked
Utah	Code 13-44-202	None	AG and Utah Cyber Center, 500 or more	1,000 or more	Not checked
Vermont	9 V.S.A. 2435	45 days	AG or Dept. of Financial Regulation, any breach, preliminary notice within 14 business days	Not checked	Not checked
Virginia	Code 18.2-186.6	None	AG, any breach	Over 1,000	Economic damages preserved
Washington	RCW 19.255.010, 040	30 calendar days	AG, over 500, within 30 days	Not checked	Yes
West Virginia	Code 46A-2A-101 et seq.	None	Not checked	Over 1,000	Not checked
Wisconsin	Stat. 134.98	45 days	Not checked	1,000 or more	Not checked
Wyoming	Stat. 40-12-501, 502	None	None in statute; AG may sue	Not checked	Not checked

Puerto Rico (10 L.P.R.A. 4051 and following), Guam (9 GCA 48-10 and following) and the U.S. Virgin Islands (14 V.I.C. 2208 and 2209) also have breach laws, per NCSL. For Puerto Rico, a law firm chart (not the statute text) reports notice to clients "as expeditiously as possible," a report to the Department of Consumer Affairs (DACO) within a non-extendable 10 days after the breach is detected, a public announcement by DACO within 24 hours after that, and fines of $500 to $5,000 per violation. The Guam and Virgin Islands terms were not checked for this lesson. The Oklahoma row comes from the enrolled text of SB 626 on the Oklahoma Legislature's site, and the Pennsylvania row from the Pennsylvania Attorney General's BPINA page, both read in October 2026.

Federal overlays

Federal breach rules do not replace state law for most businesses. They stack. A hospital in Idaho with a ransomware attack owes patients HIPAA notice, and if Social Security numbers were taken it also has to think about Idaho's law, though 28-51-106(2) deems an entity that follows its federal regulator's breach procedures to be in compliance with Idaho's. Other states have similar deemed-compliance clauses for HIPAA and GLBA entities, and some do not.

Federal rule	Who it binds	Trigger	Clock	Who gets told	Lesson
HIPAA Breach Notification Rule, 45 CFR 164.404 to 164.408	Covered entities and business associates	Breach of unsecured protected health information (presumed unless a risk assessment shows low probability of compromise)	Without unreasonable delay, no later than 60 calendar days after discovery	Individuals; media if over 500 in a state; HHS (500 or more within 60 days, smaller ones in an annual log)	03
FTC Safeguards Rule, 16 CFR 314.4(j)	Non-bank financial institutions under FTC jurisdiction (auto dealers, tax preparers, mortgage brokers and more)	Notification event involving at least 500 consumers	As soon as possible, no later than 30 days after discovery	The FTC, on its online form	04
SEC cybersecurity disclosure, Form 8-K Item 1.05 (SEC 2023-139)	Public companies	A cybersecurity incident the company determines is material	Four business days after the materiality determination; delay possible if the U.S. Attorney General finds a national security or public safety risk	Investors, through a public filing	07
FCC CPNI rule, 47 CFR 64.2011	Telecommunications carriers	Breach of customer proprietary network information	Law enforcement (Secret Service and FBI) within 7 business days of reasonable determination; customers generally after a further 7 business days	Law enforcement first, then customers	07
FTC Health Breach Notification Rule, 16 CFR Part 318	Health apps and vendors of personal health records not covered by HIPAA	Breach of security of identifiable health information	See lesson 03	Individuals, the FTC, sometimes media	03

Two cautions. The eCFR page for 47 CFR 64.2011 shows the 2023 FCC amendments (published at 89 FR 10002 on February 12, 2024) as linked but not yet folded into the text, so check the current version before quoting the carrier rule. And the federal cyber incident reporting law for critical infrastructure, CIRCIA, reaches companies through a CISA rule whose status is in lesson 07; it is a report to the government, not a notice to people.

Worked cases

Questions and answers

Do I have a right to a breach letter?

If your state's listed data about you was breached and no exception applies, the company or agency owes you notice under your state's law. Whether you can sue to enforce that duty is a separate question; in most states the attorney general enforces it.

Why did I get a letter months after the hack?

Clocks usually run from discovery or from the determination that a breach occurred, not from the intrusion. Law enforcement can also request a delay, as the Justice Department did twice in the AT&T case. Ask the company for its dates.

The letter came from a company I never did business with. Why?

It was probably a vendor or a data processor for a company you did deal with, or a data broker. The owner-licensee rule puts the duty on whoever owns the data, but owners sometimes let the vendor send the letters.

Is free credit monitoring enough?

Monitoring tells you after an account is opened. A freeze stops most new accounts from being opened at all, and it is free. Use both if monitoring is offered.

Does a breach of my email password count?

In states that list online credentials (California, Colorado, Maryland and many others), yes. In Idaho, as of October 2026, no: the list is limited to Social Security, license or state ID, and financial account numbers with their codes.

Does the 30-day rule in California apply to an Idaho company?

It applies to notices owed to California residents, whatever the company's home state. California's statute reaches a person or business that conducts business in California and owns or licenses computerized data including personal information.

What about paper records?

Idaho's law covers computerized data only, and so do most state breach statutes. HIPAA reaches protected health information in any form, paper included.

Where do I complain if a company never told me?

To your state attorney general. In Idaho, that is the Consumer Protection Division, which takes complaints online and at 1-800-432-3545. For health data, also the HHS Office for Civil Rights; for a financial company under the Safeguards Rule, also the FTC.

Hard questions

Should Congress pass one national breach law that preempts the states?

Businesses and their trade groups argue that 50-plus different clocks, thresholds and content rules raise costs without helping anyone, and that one federal standard would mean faster, clearer letters. State attorneys general and consumer groups argue that preemption would likely lock in a weaker floor and strip states of the ability to move fast, as California did with its 30-day rule in 2025. The broad federal privacy bills of recent years, the American Data Privacy and Protection Act (2022) and the American Privacy Rights Act (2024), both stalled, and lesson 07 covers the preemption fight that slowed them. What is settled: as of October 2026, no general federal breach law exists.

Fixed deadlines or a reasonableness standard?

Supporters of fixed counts point to cases where "without unreasonable delay" stretched into many months, and say a number gives regulators something to enforce. Supporters of the standard say every breach differs, that a rushed letter can be wrong about what was taken, and that a fixed count invites companies to wait until day 29. The statutes split the difference: every fixed-count law also keeps the "without unreasonable delay" duty.

Should breach laws let people sue?

Plaintiffs' advocates argue that attorney general offices are small and that only the risk of damages changes security budgets; California's 1798.150 is their model. Business groups argue that per-person statutory damages in class actions produce huge settlements unrelated to actual harm, and that most of the money goes to fees. Federal courts add a further gate: after TransUnion v. Ramirez (2021), a plaintiff in federal court needs a concrete harm, which leaves many breach suits in state court. The states have chosen both ways, as the table shows.

Should a harm test let companies skip notice?

Those who favor harm tests say notices about data no one will misuse breed letter fatigue, so people ignore the ones that matter. Those against say the company deciding there is no risk is the party with the most to gain from that finding, and that people can judge their own risk. Alaska's and South Dakota's middle path, allowing the finding only after telling the attorney general, puts a second set of eyes on it.

Should the encryption safe harbor be broader or narrower?

A broad harbor rewards companies that encrypt, which is the behavior lawmakers want, and costs nothing when encryption works. Critics note that encryption is only as good as key management, and that companies sometimes claim the harbor without proof the key was safe. The Texas key exception and Idaho's "either the name or the data elements" wording are each attempts to close that gap.