Data Breach Notification Laws by State: Which Deadline Binds

In a breach that crosses state lines, one or two clocks set the date you must hit, and in our analysis they are often regulator clocks, not the consumer deadlines on 50-state charts. There is no general federal breach notification law. Each of the 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands (54 jurisdictions, per the NCSL list) has its own, and the law that applies usually follows where the affected person lives, not where your company sits. Texas is the exception to watch: its statute covers "any individual" and lets you give non-Texans notice under their home-state law.

This guide is for the security or privacy lead who works with counsel in the first week and for the CISO who has to tell executives which date is the real one. It ends in one notification calendar. It does not restate each state's rules; the state explainers on this site (California, New York, Florida) and the HIPAA guide do that.

How long do we have to notify a data breach?

It depends on which states and sectors are in play. The useful question is which clock starts from which event, because day counts alone mislead. Statutes read for this guide use five kinds of clock:

These are examples, not a count or a complete list. Colorado's 2023 statute text (Colo. Rev. Stat. § 6-1-716, 2023 compilation) also runs 30 days from determination; counsel confirms the current text before a Colorado row goes on your calendar. Delaware adds that a shorter time under federal law controls. Every state statute named here lets notice wait for a law-enforcement investigation, and the delay turns on the agency, not the company. In California, New York, Texas, Florida, Massachusetts, Delaware, Washington and Colorado's 2023 text, the agency determines that notice would impede (in Florida, interfere with) a criminal investigation; Florida also requires the agency's written request. Vermont delays consumer notice at an agency's request, and Oklahoma when an agency determines and advises, both for a wider set of investigations and security interests. Maine lets notice wait for no longer than 7 business days after the agency determines it will not compromise a criminal investigation. Until the agency acts, the deadline stands. California, Texas, Washington, Vermont and Colorado's 2023 text also allow delay to determine scope, and New York only for law enforcement.

Who is the first person to notify?

Someone inside the company, before any external notice: counsel, then the insurer as the policy requires, per your incident response plan. No statute governs internal escalation; this is our practice advice. The reason is practical: counsel should shape the facts that every later notice repeats, and your policy may set its own notice conditions.

Step 1: Do the data and the incident trigger the laws?

Two tests: did the exposed data elements count, and was it the kind of event the statute calls a breach. Counsel decides both, on facts from the forensics lead and the privacy lead. Start on the day of discovery: every clock in Step 3 depends on the answer.

Data elements. Examples from the statutes of California, New York, Florida, Texas, Massachusetts and Delaware, plus Vermont for credentials:

Build your list from the statutes of the states in your data set; the NCSL page does not break elements out.

Access versus acquisition. Some statutes trigger on unauthorized access, others on acquisition. New York ("unauthorized access to or acquisition of") and Florida ("unauthorized access") are access states. California ("unauthorized acquisition"), Texas, Delaware (acquisition) and Massachusetts ("acquisition or use") use acquisition. The FTC Safeguards Rule presumes unauthorized access to unencrypted customer information is acquisition unless you have reliable evidence otherwise.

Ransomware without proven exfiltration. Our reading of those texts: in an access state, encryption of the data by an intruder is plausibly enough; in an acquisition state the question is whether acquisition is established or reasonably believed; under the FTC rule, access is presumed to be acquisition. Counsel makes that call state by state; the forensics lead documents the exfiltration evidence either way.

Encryption and keys. Texas, California, New York, Delaware, Massachusetts and the FTC rule exclude encrypted data, but not if the key was compromised too. Florida's text has no key clause: it excludes data that is encrypted or otherwise rendered unusable, and counsel decides whether data whose key was also taken still qualifies.

Risk-of-harm exceptions are not private everywhere. Florida allows the no-harm exception only after an appropriate investigation and consultation with law enforcement, and requires a written determination, kept five years and sent to the department within 30 days. Vermont requires a no-misuse determination and explanation sent to the AG. New York's inadvertent-disclosure determination must be written, kept five years, and sent to the AG within ten days if over five hundred residents of New York are affected. Colorado's 2023 text excuses notice where misuse has not occurred and is not reasonably likely. Massachusetts builds harm into the definition. In our reading, California and Texas have no risk-of-harm exception.

Vendor-caused incidents. The maintainer tells the data owner; the owner tells individuals. The maintainer's clock: immediately in Texas, within 10 days in Florida, immediately and within thirty days in New York. The vendor's contract should say the same, and shorter.

Step 2: Residents of which states?

No statute explains how to find residence; Texas allows written notice "at the last known address". Our practice, to confirm with counsel: use the mailing address on file, then billing address, then employee payroll state. For records with none, decide with counsel whether to notify on the best available data or treat the state as triggered. Count residents per state now, because AG and CRA thresholds depend on the per-state count. The privacy lead owns the counts and has them before the first regulator notice is due.

Step 3: Which clocks and which regulators?

For each triggered state, record the start event, the deadline, the regulator thresholds and the form. The privacy lead keeps the calendar; counsel signs off on each start event. Examples:

Do not wait for a final count: Massachusetts says notice "shall not be delayed on grounds that the total number of residents affected is not yet ascertained". Regulator portals and forms change, so confirm each filing channel the day you file.

Step 4: Which sector rules run faster?

Check these on top of the state clocks, on day one, because they often bind first. Counsel owns this check; the CISO supplies the incident facts the DFS and SEC clocks run from.

• NYDFS Part 500 covered entities: 72 hours after determining a cybersecurity incident has occurred (DFS's cybersecurity incident notice page).
• SEC Form 8-K Item 1.05 (Form 8-K General Instruction B.1): four business days after the registrant determines the incident is material. The clock runs from the materiality determination, not discovery.
• FTC Safeguards Rule (non-bank financial institutions), 16 CFR 314.4(j)(1): notify the FTC for 500 or more consumers, no later than 30 days after discovery.
• HIPAA, 45 CFR 164.404-164.408: 60 calendar days after discovery for individuals, media notice when more than 500 residents of a State or jurisdiction are involved, HHS contemporaneously for 500 or more individuals. See the HIPAA guide on this site.
• CIRCIA: as of November 2026, CISA said it "continues to work on the final rule," and until the final rule takes effect, organizations "are not required to submit covered cyber incident or ransom payment reports under CIRCIA."

In the states read for this guide, compliance with a sector rule does not remove the state regulator notice. New York relieves only the resident notice for GLBA, HIPAA or Part 500 entities, and the AG, Department of State and State Police are still notified; HIPAA entities also copy the AG within five business days of notifying HHS. California's HIPAA clause covers notice content only. Florida deems notice under a federal regulator's procedures to satisfy individual notice, and a timely copy of that notice to the department satisfies the department notice. Ask counsel about each state in your set.

How to build one notification calendar

List every triggered jurisdiction and sector rule, record each start event and compute the due date from it. We plan around one rule: the earliest date wins, sector clocks included. Then work backward: the binding date sets when the first notices go out.

Worked example (fictional; role titles only). A privately held non-bank lender licensed in New York finds a ransom note on Monday, March 1, 2027 and treats it as a cybersecurity incident that day. On Friday, March 5, forensics confirms customer files were copied. About 2,000 customers are affected, 400 of them in Texas and the rest in New York, Vermont and Massachusetts.

The binding date is not a consumer clock. The DFS notice comes due on March 4, three days into the incident, then the Vermont AG notice on March 19, both before any 30-day consumer clock. The team plans one consumer mailing near March 24, comfortably before March 31, and the Massachusetts letter goes in that mailing in its own version. Counsel confirms how each rule counts days before the dates go on the calendar.

Breach notification letter template

Start from the FTC model "Notice of Data Breach" letter in its business guide (headings: What Happened? / What Information Was Involved? / What We Are Doing / What You Can Do / Other Important Information / For More Information). California accepts the model form or those headings. One letter does not fit every state: Massachusetts bars the resident notice from stating the nature of the breach or the number of residents affected, and requires it to tell residents of their right to obtain a police report, how to request a security freeze and what information to provide, that a freeze is free, and what mitigation services you offer (Mass. Gen. Laws ch. 93H, § 3(b)). That version is built separately in the template.

Massachusetts, Delaware and California are examples, not the full list of states that require a monitoring offer. Before the letter versions are final, counsel checks each triggered state's content rules and adds them to that state's version.

Checklist before the first notice goes out

• Every triggered state is on the calendar with a start event and computed due date (privacy lead).
• Start events (discovery vs. determination) signed off (counsel).
• Regulator and CRA notices queued, with portals confirmed (privacy lead).
• Sector notices queued (DFS, FTC, SEC, HHS) and their clocks checked (counsel).
• Letter variants ready per state, including Massachusetts without nature or count and with its police report, security freeze and mitigation items (privacy lead; counsel reviews).
• Monitoring offers match each state's requirement (counsel).
• Call center script ready and matches the letter (communications lead).
• Substitute-notice conditions (cost, number of people, missing contact information) checked in each triggered state (counsel).
• A written record of every no-notice decision, sent to the regulator where the state requires it (counsel).

Deadlines and regulator notices in five states

One line each; the state pages carry the detail.