If Your Small Business Has a Data Breach: Notification Basics

There is no single U.S. state-breach deadline that safely replaces a state-by-state analysis.

There is no single U.S. state-breach deadline that safely replaces a state-by-state analysis. A small company cannot determine breach-notification duties from its headquarters alone. State laws are generally tied to affected residents and differ on what counts as personal information, what triggers notice, timing, letter content, and when an attorney general or consumer reporting agency must also be notified. Build a resident-by-state table early. Then have the current law for every affected state checked against the facts rather than applying one made-up nationwide deadline.

Start with where affected people live, not where your server sits

The first legal map is built from affected people and data, not from the company headquarters. Record each affected person’s state of residence, the exact data elements involved, whether the data was encrypted, what the investigation supports about access or acquisition, and the discovery timeline. Those facts determine which state definitions and clocks need review. A company with residents in five states may need five state analyses even if every server is in one state.

State definitions and deadlines are not interchangeable

Use California as a threshold example, not as a template for every state. Its Attorney General says a business that is required to notify more than 500 California residents must electronically submit a sample copy of that notice to the AG. That tells a tiny team to track resident counts and regulator thresholds alongside consumer notices. For every other affected state, pull the current statute or regulator guidance and record its own trigger, timing language, content requirements, and regulator-notice rules instead of cloning the California workflow.

Sector rules sit on top of state law only when the entity and data fit them. A covered entity or business associate handling PHI may face HIPAA Breach Notification Rule duties; a covered financial institution may have FTC Safeguards Rule obligations, including the FTC security-event reporting requirement in defined circumstances. These triggers are fact-sensitive. When multiple states or regulated datasets are involved, legal review is far safer than copying a template notice from another breach.

Add sector rules only when the business actually falls under them

Sector rules may add a second notice track. Under the HIPAA Breach Notification Rule, covered entities and business associates have specific duties for breaches of unsecured protected health information, including individual notice without unreasonable delay and no later than 60 days for covered breaches. Do not apply that deadline to an ordinary retailer merely because health-related information appears somewhere in a file; first determine whether HIPAA actually governs the organization and data.

Use counsel when multi-state facts or regulated data make the trigger unclear

Covered financial institutions under the FTC Safeguards Rule have separate security obligations, and certain notification events involving the unencrypted information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. That federal rule is not a substitute for state breach analysis. A single incident can require parallel state, contractual, insurer, and sector-specific decisions.

A breach-notification triage sheet

Close the notification workstream only after the team can show what happened, whose data was involved, where affected people reside, which laws or contracts were analyzed, who approved the decision, and what notices were actually sent. Preserve the legal analysis and the exact notice versions. If facts change—such as a later forensic finding that more records were accessed—reopen the matrix rather than assuming the first decision still fits.

Build a resident-by-resident legal map before choosing a deadline

California's public breach-notice archive is useful as a reality check after the legal trigger has been analyzed. It shows how organizations describe the incident, identify exposed data, explain protective steps, and provide contact information to affected residents. Use those notices to calibrate clarity and completeness, not as a fill-in-the-blanks template: the facts, resident states, data elements, legal citations, regulator thresholds, and protective offers in another company's incident may be entirely different from yours. Draft from your incident matrix and the laws that apply to your affected residents, then use public examples only to test whether the letter is understandable.

Put every non-state obligation on the same incident calendar, but label why it exists. A cyber-insurance policy may require rapid notice to preserve coverage; a customer contract may impose its own notification clause; a payment-card or government agreement may require another contact path. Those contractual clocks do not automatically change a state statute, and a state statute does not satisfy a separate contract. Record the owner, trigger, due date, approver, and evidence of completion for each track so a team of three or five people can see what remains open without merging unlike obligations.

Do not draft the consumer letter before the scope facts stabilize enough to support it. FTC breach-response guidance recommends clear, non-misleading communication that tells people what happened, what information was involved, what the company has done, and what people can do. At the same time, do not use “the investigation is ongoing” as a reason to ignore an applicable statutory clock. Track discovery date, resident states, notice thresholds, law-enforcement delay requests, contracts, and sector rules in one matrix. For a real breach, have qualified counsel review the jurisdictions and facts; an educational checklist cannot determine a company’s legal obligations from a headline alone.