The United States has no single national data breach notification law. Instead, you answer to a patchwork: a law in every state, plus federal rules that apply by industry, such as HIPAA for health data. Which duties apply to you depends on where the affected people live, what data was exposed and what kind of business you run. The shortest clock usually decides your timeline.
This guide explains how the layers fit together, what triggers a notice, who must be told and how fast, what Texas requires, and how to handle a breach that crosses state lines.
TL;DR
- There is no national breach law. All 50 states have their own, and federal rules such as HIPAA apply by sector.
- State law generally follows the residence of the affected person, so a multi-state breach means several laws at once.
- Deadlines range from 30 days in some states to "without unreasonable delay" in many others. Texas sets 60 days for individuals and 30 days for the Attorney General.
- Build your incident response plan before a breach, with counsel and a state-by-state count of affected people.
Table of Contents
- How federal and state laws fit together
- What triggers a notice: personal information and incident definitions
- Who must be notified and how fast
- Texas breach notification requirements
- Handling a breach that crosses state lines
- A step-by-step response after you discover an incident
- Perspective: notice duties are a program problem, not a paperwork problem
- Get ready before a breach forces the question
- FAQ
- Sources
How federal and state laws fit together
Think of two layers. The first is state law: every state has a statute requiring private businesses, and in some cases government agencies, to notify people when their personal information is compromised. The IAPP's state chart tracks 54 state and territorial jurisdictions and notes that the variations make compliance difficult even though the mandate is nationwide.
The second layer is federal, and it is sector-specific:
- HIPAA covers health plans, providers and their business associates.
- The FTC Health Breach Notification Rule covers vendors of personal health records and related entities that HIPAA does not reach.
- The FTC Safeguards Rule covers nonbank financial institutions.
- SEC Regulation S-P covers certain financial institutions registered with the SEC.
The layers interact. Some state laws exempt entities that already comply with federal notification rules such as HIPAA or Gramm-Leach-Bliley. Exemptions differ by state, so never assume one applies without checking the statute or asking counsel.
If you want a wider view of the compliance duties that sit around these laws, our overview of types of legal data compliance requirements is a good companion.
What triggers a notice: personal information and incident definitions
Two questions decide whether a law applies: was the data covered, and did the incident meet the statute's trigger?
What counts as personal information
Most states define personal information as a person's first name or initial and last name combined with a sensitive element. According to a January 2026 state breach matrix, those elements typically include Social Security numbers, driver's license or state ID numbers, and financial account numbers with the required security code.
Some states go further. California's statute also covers medical information, health insurance information, unique biometric data, genetic data and login credentials for online accounts. A breach of a client portal with stolen email and password pairs can therefore trigger duties in California even when no Social Security number was touched.
What counts as a breach
Statutes differ on the trigger. Many use "unauthorized access," "unauthorized acquisition," or both, and some also require a risk of harm or identity theft before notice is owed. The Privacy Rights Clearinghouse also points to differences such as whether individuals can sue under the statute.
The practical lesson: do not run a single "is it a breach?" test. Run it once per state whose residents' data was involved.
Who must be notified and how fast
The recipients vary, and so do the clocks. NACHA's incident response guide recommends checking whether notice is owed to affected individuals, state regulators, federal regulators, the media and consumer reporting agencies, because duties and thresholds vary by jurisdiction and sector.
State deadlines at a glance
According to the Privacy Rights Clearinghouse 2026 survey, which reflects statutes as of January 1, 2026, only 20 states set a numeric deadline for consumer notice. The rest use language such as "without unreasonable delay."
| Deadline for consumer notice | States named in the survey |
|---|---|
| 30 days | California, Colorado, Florida, New York, Washington |
| 45 days | Alabama, Arizona, Indiana, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, Wisconsin |
| 60 days | Connecticut, Delaware, Louisiana, South Dakota, Texas |
| No fixed number | Most remaining states: "without unreasonable delay" |
Legislatures amend these statutes often. Confirm the current text before you rely on any figure, including this table.
Federal deadlines by sector
- HIPAA: covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, per HHS. Separate regulator and media requirements also apply.
- FTC Health Breach Notification Rule: for vendors of personal health records and related entities, individual notice is due without unreasonable delay and within 60 calendar days of discovery. For breaches affecting 500 or more people, the FTC must be told within 10 business days, and prominent media must be notified when 500 or more residents of one state or jurisdiction are affected. The amended rule text also requires substitute notice through a website or media when contact information is insufficient for 10 or more individuals.
- SEC Regulation S-P: as amended in May 2024, it requires covered institutions to notify individuals as soon as reasonably practicable, and no later than 30 days after becoming aware of unauthorized access to or use of customer information, according to Ashurst.
- FTC Safeguards Rule: the same source reports that, from September 2024, nonbank financial institutions covered by the amended rule must notify the FTC of security incidents involving more than 500 people.
For deeper sector guides, see our pieces on HIPAA breach notification requirements, the FTC Safeguards Rule and SEC cybersecurity disclosure rules.
What a notice should contain
Content rules differ by state, but the FTC rule gives a useful baseline. Notices should describe the incident, identify the information involved, explain what individuals can do to protect themselves and give a way to reach you. Many state laws ask for similar elements, and some add state-specific language or require a copy to go to a regulator.
Texas breach notification requirements
Houston businesses, Gulf Coast energy operators and Texas law firms hold data on Texans, so Texas law is the first one to know. It has two notice tracks.
- Notice to individuals. A business that conducts business in Texas and owns or licenses computerized sensitive personal information must notify each affected person without unreasonable delay, and generally no later than 60 days after determining a breach occurred.
- Report to the Attorney General. For breaches involving 250 or more Texans, the Texas Attorney General's data breach page states that businesses must notify both the Attorney General and affected consumers. The report goes in electronically, within 30 days of discovery, using the official Data Breach Report form.
Texas also lets an affected resident of another state receive notice under that state's law or under Texas law for consumer notice, according to the same law firm summary. That can simplify a multi-state mailing, but it does not remove regulator-reporting duties elsewhere.
A practical note for law firms and energy companies: your client or counterparty contracts may impose faster notice than any statute. Many require notice within days. Read them before you need them.
Handling a breach that crosses state lines
The Legal 500 guide to US data protection notes that state laws more often protect consumers residing in that state. NACHA's guide agrees that applicable laws depend on where affected individuals live. A national customer base can mean notices in nearly every state at once.
A workable approach:
- Map the data. Identify which records were involved and the home state of each person.
- Count per state. Thresholds such as Texas's 250-resident rule are state-based, so keep a separate count for each state after applying that state's definitions and exemptions. A nationwide total will not tell you which regulators to call.
- Find the shortest clock. Build one timeline around the strictest deadline that applies and send everything on that schedule.
- Reconcile differences. Carnegie Mellon researchers advise mapping requirements to each jurisdiction and keeping a record that traces each action to the legal requirement behind it. That record helps you defend your decisions later.
- Layer in federal rules. If you handle health or financial data, check HIPAA, FTC or SEC duties alongside the state analysis.
Health technology vendors also have to think about what happens to devices holding protected data after an incident or at end of life. A walk-through of HITECH disposal steps helps teams keep that part of the program audit-ready.
A step-by-step response after you discover an incident
NACHA recommends assessing each incident case by case, consulting legal counsel, determining whether a breach occurred, considering the data and applicable laws, and notifying recipients as required. It also advises that notification be handled by the legal team with outside counsel. Here is how that looks in practice:
- Contain and preserve. Stop the exposure and preserve logs and images before anything is wiped.
- Engage counsel. Counsel directs the analysis, which keeps notice decisions defensible.
- Determine scope. Establish what data was accessed or acquired, and whether it was encrypted or otherwise unreadable.
- Identify the people and their states. Build the per-state counts described above.
- Set the deadlines. Start the clock at the date state law, HIPAA or contract defines as discovery. It is not always the date you first suspected a problem.
- Notify in the right order. Regulators, individuals, media and consumer reporting agencies each have their own triggers. Check them one by one.
- Document everything. Keep the decisions, the dates and the reasoning.
Law firms face added pressure because client confidentiality duties sit on top of statutory ones. Our guide to a legal sector incident response plan covers what to prepare ahead of time, and cyber risk and firm reputation covers the communications side.
Perspective: notice duties are a program problem, not a paperwork problem
Most organizations meet breach notification law for the first time in the middle of a crisis. That is the worst moment to learn that a client contract demands notice in 48 hours, that a Texas count and a California count are different numbers, or that nobody knows which systems hold regulated data.
We see the same pattern in law firms, energy operators and mid-sized regulated businesses. The legal text is only part of the work. The harder part is knowing, before an incident, where personal information lives, who owns the response, and which framework each data set falls under. A virtual CISO builds that foundation: a risk assessment, a current data inventory, an incident response plan with named roles, and a calendar of the deadlines that matter for your footprint.
This is why we pair vCISO leadership with a platform that supports 50+ compliance frameworks. When one incident touches HIPAA, state law and a customer contract, you want the mapping done in advance, with board-ready reporting that shows leadership where the exposure sits. Doing this with a fractional leader costs far less than a full-time executive, and it means the first time your team runs the playbook is not the real one.
vCISO
Get ready before a breach forces the question
CISOSafe is a Houston-based vCISO firm with an AI-powered platform for regulated industries. We help law firms, oil and gas companies and compliance-sensitive mid-market organizations assess risk, build incident response plans, develop policies and controls, and prepare for audits and certifications.
If you want your notification duties mapped to your actual data and states, talk to us about vCISO, risk assessment and compliance program services. You can also start from our home page to see how the platform and advisory work together.
For firms building out a security program, our guide to legal industry cybersecurity frameworks is a good place to choose a structure, and the HIPAA Security Rule guide and business associate guide cover health data in more depth.
FAQ
Is there a federal data breach notification law for all businesses?
No. The US has no single national law, and federal rules apply by sector, for example HIPAA for health data. Every state also has its own statute. Most businesses therefore follow state law, plus any federal rule tied to their industry.
What is the Texas deadline to report a data breach?
Texas requires a report to the Attorney General within 30 days of discovery when 250 or more Texans are affected, filed electronically on the official form. Individual notice is generally due no later than 60 days after you determine a breach occurred. Check the Attorney General's page for the current form and rules.
Which state's law applies if customers live in several states?
Usually the law of each affected person's state of residence. You track affected people state by state and meet each state's duties, with the shortest deadline setting your working timeline. Some states, including Texas, let residents of other states receive notice under either their own state's law or Texas law for consumer notice.
Does HIPAA replace state breach laws?
Not automatically. Some states exempt entities that comply with HIPAA or similar federal rules, but exemptions vary and some state duties, such as attorney general reporting, may still apply. Ask counsel to review the statute for each state involved.
Who should send breach notices?
NACHA's guidance says notification should be carried out by the legal team in consultation with outside counsel. Your security and communications leads support them with facts about scope and a clear message for affected people.
Sources
- Recent Developments: US Data Breach Reporting Obligations (Mondaq)
- IAPP: US State Data Breach Notification Chart
- Privacy Rights Clearinghouse: Data Breach Notification in the United States and Territories
- Mintz: State Data Security Breach Notification Laws matrix
- California Civil Code 1798.82
- PrivacyPlan: Breach Trigger Analysis
- NACHA: Security Incident Response Procedure Guide
- Privacy Rights Clearinghouse: 50-State Survey, 2026 Edition
- HHS: Breach Notification Rule
- FTC: Health Breach Notification Rule
- eCFR: 16 CFR Part 318
- Ashurst: 2024 Breach Notification Law Update
- Texas Attorney General: Data Breach Reporting
- Texas Data Breach Notification (Fasthoff Law Firm)
- Legal 500: US Data Protection and Cybersecurity
- Multi-State Breaches: Sequencing Against the Shortest Clock
- Carnegie Mellon: Reconciling Multi-jurisdictional Legal Requirements
- HITECH disposal steps for US teams