Breach notification is not only for Fortune 500s
If your business stores customer emails with passwords, employee Social Security numbers, payment card data, or health information, you are in the blast radius of U.S. state data breach notification laws. All fifty states have enacted breach notification statutes. They differ on definitions, deadlines, and whether you must notify attorneys general or consumer reporting agencies—but ignorance of the patchwork is not a defense when a laptop is stolen or a SaaS vendor is ransomed.
Small companies often assume notification is a PR choice. It is a legal duty once statutory triggers are met. Failing to notify on time can bring civil penalties, private lawsuits in some jurisdictions, and contractual claims from enterprise customers who required flow-down security terms in their vendor agreements.
What usually counts as a notifiable breach
Most state laws focus on unauthorized acquisition of computerized personal information. “Personal information” commonly includes a name combined with a Social Security number, driver’s license number, or financial account number with access code. Many states have expanded definitions to cover biometric data, usernames with passwords, and tax ID numbers. Encrypted data is often excluded if the encryption key was not also compromised—but weak hashing of passwords may not qualify as encryption under a given statute.
A ransomware incident that locks systems without exfiltration can still trigger notice in some states if personal information was reasonably believed accessed. Vendor breaches count: if your payroll provider is compromised and your employees’ data was involved, you may still have notification obligations as the business that collected the data in the first place.
Timelines and who gets notified
Deadlines vary. Some states require notice “without unreasonable delay,” others set fixed periods such as thirty or forty-five days after discovery, sometimes with shorter windows for regulator notice. “Discovery” typically means when you reasonably should have known of the breach after a prompt investigation—not when you finish a perfect forensic report months later.
- Individuals: Written, electronic, or substitute notice depending on contactability and cost thresholds.
- State attorneys general / agencies: Often required above a headcount threshold of affected residents.
- Credit bureaus: Sometimes required when large numbers of residents are affected.
- Industry regulators: HIPAA, GLBA, or state insurance regulators may impose parallel duties.
Multi-state customer bases create multi-state analysis. If you have residents in many states, counsel often prepares a notice that meets the strictest applicable requirements rather than sending fifty slightly different letters. Location of the resident—not only your HQ—usually drives which law applies to that person.
The first seventy-two hours
Contain the incident: isolate affected systems, rotate credentials, preserve logs. Engage a forensics firm under attorney privilege when appropriate. Start a factual timeline: what data elements existed, what systems were touched, whether exfiltration indicators appear. Notify your cyber insurance carrier promptly; late notice can jeopardize coverage. Do not publicly speculate about root cause before facts stabilize.
Draft notices in plain language: what happened, what information was involved, what you are doing, how individuals can protect themselves, and how to contact you. Offer credit monitoring when appropriate for sensitive identifiers. Coordinate with law enforcement if they request a short delay—some statutes allow limited delay for criminal investigation.
Contracts and preparation beat panic
Before an incident, inventory where personal data lives, including shadow IT spreadsheets and “temporary” cloud folders. Sign vendor agreements that require prompt breach notice to you, cooperation on forensics, and minimum security controls. Maintain an incident response roster with counsel, IR firm, PR, and executive decision makers. Tabletop a ransomware scenario once a year so the first call list is not improvised at 2 a.m.
Encryption at rest, MFA, least-privilege access, and immutable backups reduce both breach likelihood and notification scope. Document your security program; regulators and counterparties increasingly ask how you decided what was “reasonable” for a company of your size.
Practical takeaway for owners
You do not need to memorize every statute. You do need a playbook: know what personal data you hold, who your counsel and insurer are, and how quickly you can determine whose information was implicated. When in doubt after a suspected breach, call qualified privacy counsel early—timeline clocks often start at discovery, not at the day you feel ready to talk publicly.
Keep a one-page breach cheat sheet printed and in shared drive: counsel phone, insurer claim number, forensics retainer contact, and the executive who can approve customer notice language. In a real incident, searching for that information wastes hours you may not have.