Data breach notification laws and what they cost

All 50 states, the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands have laws requiring businesses to notify people whose personal information is exposed in a breach, according to the National Conference of State Legislatures. The law that applies is generally that of each affected person's state of residence, not the state where your business sits, so a company with customers in ten states can face ten sets of rules. A cyber policy's breach response coverage pays for the notification work, but it does not change the deadlines.

What triggers a duty to notify

The statutes differ in detail, but NCSL describes the common building blocks: who must comply, a definition of personal information, a definition of breach, rules on timing, method and who is notified, and exemptions such as encrypted data.

• Personal information. Usually a first name or initial and last name combined with a Social Security number, driver's license or state ID number, or financial account number. Many states add medical information, biometric data, tax IDs or an email address with a password.
• Breach. Most statutes turn on unauthorized acquisition of, or access to, the data. Some add a risk-of-harm test that lets you skip notice if misuse is not reasonably likely, and that test is a judgment for counsel, not a default.
• Encryption. Data that was properly encrypted, with the key not compromised, is commonly exempt.
• Who notifies. If you only store or process data for another business, most statutes require you to tell the data's owner promptly, and the owner notifies individuals. Check your service contracts for who pays.

A compromised email account counts if it held this data. See business email compromise and funds transfer fraud coverage for why a hijacked mailbox is often a notification event.

Examples of the rules (as of October 2026)

These four states show how much the rules vary. Statutes change, so confirm current text with counsel or the workers' comp and benefits requirements by state tool.

Sources: Florida Statutes 501.171, the Texas statute as summarized at texas.public.law, and New York GBL 899-aa. Other states set their own standards, from "without unreasonable delay" to outer limits of 30, 45 or 60 days, so the shortest deadline among your affected residents usually governs your plan.

Federal rules that sit on top

There is no single federal breach notice law for all businesses. Sector rules apply instead:

• Health data. HIPAA covered entities and business associates have their own breach rule, with a 60-day outer limit. See HIPAA breaches and cyber insurance for healthcare providers.
• Financial institutions. Under the FTC's Safeguards Rule, covered non-bank financial institutions (mortgage lenders, tax preparers, collection agencies and others) must notify the FTC no later than 30 days after discovering an unauthorized acquisition of unencrypted customer information affecting at least 500 consumers. The requirement has been in force since May 13, 2024 (FTC).
• Public companies. The SEC's cyber disclosure rules run on a separate clock: The SEC's cyber incident disclosure rules.

What notification costs

No statute sets a price, and averages mislead because large breaches dominate them. IBM's 2026 Cost of a Data Breach Report put the global average total cost of a breach at $4.99 million, up 12%, and secondary coverage reports the U.S. average at $11.5 million. Those numbers include detection, lost business and legal costs and come from organizations IBM studied, so they say little about a 15-person firm. A better way to see the cost is as a list of line items:

1. Counsel and forensics. A privacy attorney decides who must be told and when; forensic work establishes which records were taken. Both often cost more than the mailing.
2. Mailing or email notices and a call center. Priced per person notified, plus setup.
3. Credit or identity monitoring. The FTC's data breach response guide recommends considering at least a year of free credit monitoring when Social Security numbers or financial data were exposed. A few states mandate it for certain breaches; law firm summaries report 24 months in Connecticut when Social Security numbers are involved (Hunton) and 18 months in Massachusetts (Lewis Brisbois). Verify the current statute before relying on these.
4. Regulator responses and penalties, such as the Florida and New York amounts above.
5. Litigation. In California, a consumer whose nonencrypted, nonredacted personal information is breached because of a failure to maintain reasonable security can seek statutory damages of $107 to $799 per consumer per incident, the range in effect since January 1, 2025 under the California Privacy Protection Agency's inflation notice. The multiplication is what matters. Say a hypothetical breach affects 5,000 California residents. At those rates the statutory range alone would run from $535,000 to just under $4 million before defense costs. Other states have no equivalent, and class actions rely on negligence and contract theories instead.

How a cyber policy pays

Notification costs sit in the first-party breach response part of a cyber policy (first-party vs third-party cyber coverage), and the lawsuits and regulatory defense sit in the third-party part. Points to check:

• A separate limit, so response costs do not use up the liability limit.
• Caps on the number of people covered or on monitoring cost, and whether the cap is a sublimit.
• Legally required versus voluntary notice. Some forms pay for both; some pay only when a law compels it. Ask who decides.
• Panel vendors. Insurers usually require their vendors, and a breach coach often directs them, which also helps preserve attorney-client privilege.
• Fines and penalties are paid "where insurable by law," which varies by state (are fines, penalties and punitive damages insurable?).
• Late notice to the insurer. Waiting until the notification deadline is near can cost you coverage on a claims-made form. See what happens when you file a cyber claim.

A decision process

1. Preserve evidence and bring in counsel and the insurer's hotline.
2. Have forensics identify the data elements and the people affected.
3. Map affected individuals by state of residence.
4. For each state, note the individual deadline, the regulator threshold and whether encryption, risk-of-harm or law enforcement delay applies.
5. Plan to the shortest deadline and document every decision, including a decision not to notify.
6. Send notices that include what happened, what data, what you are doing, and whom to contact. Add monitoring where required or recommended.
7. Send regulator notices and keep copies.

A hypothetical

Say an 18-person accounting firm in Ohio finds that an attacker copied tax files for clients in Texas, New York and Florida. Forensics confirms the copying on November 3. Counsel's calendar shows the Florida deadline of 30 days after determination as the earliest, with 15 more available only for good cause. New York requires notice to individuals within 30 days after discovery and to three state offices. Texas allows 60 days, with an Attorney General report in 30 days if at least 250 Texans are affected. The firm plans to mail all notices within 30 days, files the regulator forms, and offers a year of monitoring. This illustrates the method; real deadlines turn on the exact dates and facts.

Key takeaways

• Every state, D.C. and three territories require breach notices, and the law of each affected person's residence applies.
• Deadlines range from 30 days (California, Florida, New York) to 60 days (Texas), and many states also require notice to an attorney general or other regulator.
• Costs are counsel, forensics, mailing, call center, monitoring, regulator penalties and lawsuits, and average figures from large breaches do not predict a small firm's bill.
• Check your cyber policy for a separate breach response limit, caps on notified individuals, vendor rules and how it treats voluntary notice.
• Plan to the shortest deadline, document each decision and involve counsel early.