U.S. Data Breach Notification Laws – State-by-State Reference Guide

If you face a data breach, we prepared this guide covering state requirements across the U.S. These situations can affect any business that handles personal data, including law firms, accounting practices, healthcare providers, and cybersecurity companies.

Review the official requirements for your state and ensure your response aligns with them.

As a professional liability insurance provider, L2 Insurance helps cover the risk when these obligations are not handled correctly, including claims, legal costs, and related exposure. If you want to better understand how your business can be supported in these situations, L2 Insurance is here to help you think it through.

U.S. Data Breach Notification Requirements by State and Industry

All 50 U.S. states and the District of Columbia have enacted data breach notification laws that require organizations to notify individuals when their personal information has been compromised. This document brings together each jurisdiction’s notification deadlines and key requirements into a single reference table.

Out of 51 jurisdictions, 20 states define specific deadlines, typically ranging from 30 to 60 days. The remaining 31 rely on broader language such as “without unreasonable delay” or “most expedient time possible,” which still requires a prompt and defensible response.

Federal sector-specific requirements, including HIPAA, GLBA, SEC disclosure rules, and the upcoming CIRCIA critical infrastructure reporting mandate, are included as separate rows at the end of this document.

State Notification Requirements

Federal Requirements