State Data Breach Notification Laws

What are state data breach notification laws?

State data breach notification laws tell a business what to do when personal information is exposed. Each state writes its own rules on what data counts, who must be told and how. California's law is one example. Under Civil Code section 1798.82, a business must notify California residents whose unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person.

Some laws also require telling a regulator. In California, a business that must notify more than 500 residents about one breach has to send a sample copy of its notice to the Attorney General, per the Attorney General's reporting page.

These laws sit beside sector and foreign rules. Health data has its own deadlines under HIPAA, and EU data falls under the GDPR.

Why it matters to you

A vendor breach can be your notice to send. When a vendor that holds your customer or employee data is breached, the people affected are your customers and staff. The law may expect you, as the business that owns the data, to tell them. You can only do that once the vendor tells you.

Your clock depends on your vendor's clock. Every day the vendor waits is a day you do not have. That is why the breach notification clause in your DPA or security terms matters. Stripe's DPA, for example, promises notice for GDPR and UK GDPR data that "will be no later than 48 hours." For health data, HIPAA gives business associates up to 60 days after discovery to notify, per HHS. Your own customers' contracts may ask you for much faster notice.

Lawsuits follow some breaches. Under the CCPA, California residents can sue after certain breaches caused by poor security and seek up to $750 per incident in statutory damages, per the Attorney General.

What to check

• Each vendor's breach notice promise, in hours or days. "Without undue delay" alone gives you no fixed date to plan around.
• What the vendor will tell you: what data, which people, when it happened and what it is doing about it.
• Whether the vendor will help pay for or send notices if the breach was its fault.
• Which states your customers and employees live in, so you know which laws may apply.
• Whether your vendors encrypt data, since some laws, like California's, focus on unencrypted data. See encryption at rest and in transit.

How Venpo helps

Venpo watches your vendors' DPAs, security addenda and terms and emails you a plain-English alert when breach notice periods or security commitments change, with a change history for each vendor.