Lawyer Listings Add, Update, or Remove Listings

Data Breach Notification Rights

What a business must tell you when your personal information is exposed, which laws require it, what the notice must say, and what a person whose data was breached can actually claim.

Informational only - this is not legal advice. These definitions explain general legal vocabulary in plain English. They are not advice about your situation, reading them creates no attorney-client relationship, and the law differs from state to state and changes over time. For advice you can rely on, speak to a lawyer licensed in your state.

What it means

There is no general federal data breach law. Notification is required by the statutes of every state, which apply according to the residence of the people whose information was exposed, and by federal rules for particular sectors: health information under the HIPAA breach notification rule, financial institutions under the Gramm-Leach-Bliley safeguards rule and the banking regulators, and public companies under securities disclosure rules. A single breach therefore often triggers several overlapping obligations with different definitions, deadlines and recipients.

The state statutes share a shape. They apply to unauthorized acquisition of defined personal information - typically a name combined with a Social Security number, driver's licence number, financial account number with access code, and increasingly medical, biometric and login credentials; they require notice to affected residents within a period after discovery, in a form that describes what happened, what information was involved, what the business is doing and what the person can do; and many require notice to the state attorney general and to the credit bureaus once the number affected passes a threshold. Encrypted data is usually exempt if the key was not also taken. Some states also require the business to offer credit monitoring or identity protection services for a period.

What a person can recover is less settled than what they must be told. Notification statutes mostly give enforcement to the attorney general; a private claim, where it exists, usually runs through negligence, breach of contract, the state consumer protection statute, or a specific privacy statute such as California's, which allows statutory damages for a breach caused by a failure to maintain reasonable security. Courts continue to divide on whether the risk of future misuse, without actual fraud, is an injury a plaintiff can sue on, and the Supreme Court has held that exposure without concrete harm does not by itself confer standing in federal court.

Where this comes from

State data breach notification statutes exist in every state; California's, Civil Code § 1798.82, was the first and is representative, and Civil Code § 1798.150 provides the private right of action for breaches caused by a failure to implement reasonable security. Federal sectoral rules: the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400-164.414; the FTC Safeguards Rule, 16 C.F.R. Part 314, including the notification requirement at § 314.4(j); and Item 1.05 of SEC Form 8-K, 17 C.F.R. § 249.308, for public companies. On standing, TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).

When people hire a lawyer for this

A person who receives a breach notice should act on it - freeze their credit, change the affected credentials, and keep the letter - rather than wait to see whether fraud follows, because the letter is the evidence of when they knew. Whether to sue is a question for a lawyer who handles these cases, and the honest answer is usually that individual claims are small and class actions are slow; a business that has discovered a breach needs counsel immediately, since the notification deadlines run from discovery and the analysis of which states' and which sectors' rules apply is itself the first legal task.

Find a lawyer for this in your state

Choose your state. Each link opens the directory page for the city in that state with the most currently published law firms in this practice area; a +n beside the city is how many other cities in the state also have one. The list is generated when this page loads, so a state whose listings have lapsed drops out rather than becoming a dead link.

« All glossary terms

Part of the LawyerLand plain-English legal glossary. Definitions are written from primary sources - statutes and court rules - and each entry states the authority it rests on, or says plainly when the doctrine is state law with no national rule.

If you cannot afford a lawyer, civil legal aid programmes provide free help with many of these problems: civil legal aid programmes by state.

Related free reference tools: statute of limitations for a personal-injury claim, by state, quoted from each state's official text - part of LawyerLand's legal reference tools.