Free reference 54 jurisdictions

What are the data breach notification deadlines in each US state?

Name: State data breach notification laws
Creator: RiskTemplates
License: https://creativecommons.org/licenses/by/4.0/

Short answer

All 50 states, the District of Columbia, Puerto Rico, Guam and the U.S. Virgin Islands have a data breach notification law. 22 of these 54 jurisdictions set a fixed deadline to notify affected residents — 30 days (6), 45 days (11) and 60 days (5) — and the other 32 require notice in the most expedient time possible or without unreasonable delay.

39 also require notice to the attorney general or another state agency, many only above a resident-count threshold; Maryland and New Jersey require that notice before residents are notified.

Last verified: September 30, 2026

Download CSV JSON

How to use this Sources

Fixed consumer deadlines

6 at 30 calendar days: California, Colorado, Florida, Maine, New York and Washington
11 at 45 calendar days: Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont and Wisconsin
5 at 60 calendar days: Connecticut, Delaware, Louisiana, South Dakota and Texas
32 have no fixed day count (20 "most expedient time possible", 12 "without unreasonable delay").

Regulator notice vs consumer notice

Before consumers: Maryland (Attorney General) and New Jersey (Division of State Police).

No later than consumers: Connecticut, Delaware, District of Columbia, Illinois, Montana, Nebraska, New Hampshire and Pennsylvania.

After consumers: California (within 15 calendar days after notifying consumers), Iowa (within 5 business days after consumer notice), Louisiana (received within 10 days after consumer notice) and Oklahoma (no later than 60 days after notifying residents).

15 jurisdictions require no regulator notice.

Check these on any chart you use

Exact thresholds. 17 regulator thresholds say "more than"; 6 say "or more" or "at least" (Colorado, District of Columbia, Florida, Oklahoma, Texas and Utah).
Order of notice. Maryland and New Jersey want the regulator notified first.
Florida (regulator notice timing): "no extension (the 15-day good-cause extension in 501.171(3)(a) applies only to notice to individuals under subsection (4))"
Oklahoma (credit bureau notice): "None for general entities (SB 626's 1,000 figure is the AG-notice exemption for breached credit bureaus, not CRA notice)"

What changed recently

Delaware (2026-09-02): HB 381 (85 Del. Laws c. 464, eff. 9/2/2026): HIPAA/GLBA regulated entities are deemed compliant only with the 60-day timing rule; AG notice and SSN credit monitoring still apply.
Oklahoma (2026-01-01): SB 626 (eff. 1/1/2026): AG if 500+ residents (1,000+ if the breached entity is a credit bureau), no later than 60 days after notifying residents.
California (2026-01-01): SB 446 (eff. 1/1/2026): 30 calendar days.
North Dakota (2025-08-01): DFI-regulated non-bank financial corporations also notify the DFI Commissioner for breaches of 500 or more consumers (HB 1127, eff. 8/1/2025).
Pennsylvania (2024-09-26): Act 33 of 2024 (eff. 9/26/2024): AG concurrently if >500; CRAs if >500.
New York (2024): 30 days after discovery (L.2024 ch.647).
Texas (2023-09-01): AG via the AG electronic form if at least 250 Texans, no later than 30 days after determination (SB 768, eff. 9/1/2023).

Not law: Michigan: SB 360 (2025) would add AG notice at 100+ residents; not law as of 9/30/2026. Mississippi: 2025 bills to add AG notice (SB2046/HB731) died in committee.

Amendments effective 2023 or later, as recorded in the dataset's notes.

Breach notification rules by jurisdiction

One row per jurisdiction. The bold value is the rule in short; open "Statute summary" for the fuller wording from the review. Citations link to the official or code-mirror text checked.

State data breach notification laws, 54 jurisdictions, last verified September 30, 2026
Jurisdiction	Citation	Consumer deadline	Clock starts	Regulator / AG notice	Credit bureaus	Risk-of-harm exception	GLBA / regulator deemed compliance	Notable special rules	Last verified
Alabama AL	Ala. Code § 8-38-1 et seq. (Data Breach Notification Act of 2018)	45 calendar days Statute summary As expeditiously as possible, no later than 45 days after determining a breach reasonably likely to cause substantial harm (or receipt of third-party-agent notice)	determination that the breach is reasonably likely to cause substantial harm	Recipient Attorney General Threshold: More than 1,000 residents Timing: Within 45 days (same trigger as individual notice) Statute summary Yes — if number of individuals notified exceeds 1,000 Within 45 days (same trigger as individual notice)	More than 1,000 Statute summary Notify all nationwide CRAs without unreasonable delay if >1,000 individuals notified at a single time	Yes Detail Yes — notice only if reasonably likely to cause substantial harm; written determination kept ≥5 years; no AG filing	Yes — entity subject to federal breach-notice rules (incl. GLBA) exempt if it maintains procedures, notifies individuals, and timely sends AG a copy when >1,000	Third-party agents must notify the covered entity within 10 days (8-38-8). Keep a written no-harm determination 5 years. Federally regulated entities following federal rules must still send the AG a copy when >1,000.	2026-09-30
Alaska AK	Alaska Stat. § 45.48.010 et seq.	Most expedient time possible Statute summary Most expeditious time possible and without unreasonable delay	No fixed day count	Recipient Attorney General (only when relying on a no-harm determination) Threshold: Conditional (see rule) Timing: Written AG notice before skipping resident notice (no-harm determination) Statute summary Only if entity relies on no-harm determination: written notice to AG required before skipping resident notice; no general AG notice requirement No deadline; AG written notice is a precondition of the no-harm determination	More than 1,000 Statute summary >1,000 residents: notify all nationwide CRAs without unreasonable delay (GLBA-subject entities exempt from CRA notice)	Yes Detail Yes — requires written AG notification, written determination kept 5 years	No general GLBA/federal exemption (GLBA exemption applies only to CRA notice)	AG notice applies only when relying on a no-harm determination: notify the AG in writing before skipping resident notice and keep the determination 5 years.	2026-09-30
Arizona AZ	Ariz. Rev. Stat. § 18-551 et seq.	45 calendar days Statute summary Within 45 days after determination of breach	determination of the breach	Recipient Attorney General + Director, Arizona Dept. of Homeland Security Threshold: More than 1,000 residents Timing: Within 45 days after determination Statute summary Yes — if >1,000 individuals: AG AND director of Arizona Dept. of Homeland Security (plus 3 largest CRAs) Within 45 days after determination	More than 1,000 Statute summary >1,000 individuals: notify 3 largest nationwide CRAs within 45 days	Yes Detail Yes — no notice if determined no substantial economic loss reasonably likely; no documentation/AG filing requirement stated	Yes — GLBA-subject persons and HIPAA covered entities/BAs fully exempt; federal-regulator-procedure compliance deemed compliance	Over 1,000: notify the AG, the Director of the Arizona Dept. of Homeland Security and the 3 largest CRAs within 45 days. GLBA-subject persons and HIPAA covered entities/business associates are fully exempt.	2026-09-30
Arkansas AR	Ark. Code Ann. § 4-110-101 et seq. (Personal Information Protection Act)	Most expedient time possible Statute summary Most expedient time and manner possible, without unreasonable delay	No fixed day count	Recipient Attorney General Threshold: More than 1,000 residents Timing: Same time as individual notice or within 45 days of determination, whichever is first Statute summary Yes — only if breach affects >1,000 individuals At the same time individuals are notified or within 45 days after determining reasonable likelihood of harm, whichever occurs first	None Statute summary None in statute	Yes Detail Yes — written determination and supporting docs retained 5 years; send to AG within 30 days of written request	Yes — deemed compliance if regulated by state/federal law with greater protection and at least as thorough breach rules	AG (>1,000) at the same time as individuals or within 45 days of determination, whichever is first. Keep a no-harm determination 5 years; give it to the AG within 30 days of a written request.	2026-09-30
California CA	Cal. Civ. Code § 1798.82 (and § 1798.84 remedies; CCPA § 1798.150)	30 calendar days Statute summary Within 30 calendar days of discovery or notification of breach (delay allowed for law enforcement or to determine scope/restore integrity)	discovery or notification of the breach	Recipient Attorney General (single sample copy, submitted electronically) Threshold: More than 500 residents Timing: Within 15 calendar days after notifying consumers Statute summary Yes — if >500 CA residents notified from a single breach (single sample copy, submitted electronically) Within 15 calendar days of notifying affected consumers	None Statute summary None (notice must list major CRA contacts if SSN/DL/CA ID exposed)	No Detail No — notice required on reasonable belief of acquisition; no harm threshold	No GLBA exemption; HIPAA covered entities deemed compliant with notice-content rules only if HITECH § 13402(f) followed	SB 446 (eff. 1/1/2026): 30 calendar days. AG sample copy within 15 calendar days after notifying consumers if >500. Notice must be titled "Notice of Data Breach" with the prescribed headings; if you were the source and SSN/ID numbers were exposed, offer identity theft prevention services free for at least 12 months.	2026-09-30
Colorado CO	Colo. Rev. Stat. § 6-1-716	30 calendar days Statute summary Most expedient time possible, no later than 30 days after determination of breach	determination of the breach	Recipient Attorney General Threshold: 500 or more residents Timing: No later than 30 days after determination Statute summary Yes — if reasonably believed to affect 500 or more CO residents No later than 30 days after determination of breach	More than 1,000 Statute summary >1,000 CO residents: notify nationwide CRAs	Yes Detail Yes — no notice if misuse has not occurred and is not reasonably likely; no AG filing requirement	Yes — regulated entities following regulator's breach procedures deemed compliant, but AG notice still required	AG if 500 or more Colorado residents, within 30 days after determination; CRAs if >1,000.	2026-09-30
Connecticut CT	Conn. Gen. Stat. § 36a-701b	60 calendar days Statute summary Without unreasonable delay, no later than 60 days after discovery	discovery of the breach	Recipient Attorney General Threshold: No threshold Timing: No later than notice to residents Statute summary Yes - AG notice whenever resident notice is required (no numeric threshold) Not later than the time notice is provided to residents	None Statute summary None	Yes Detail Yes - after appropriate investigation; no documentation/AG filing requirement	Yes - deemed compliant if follows primary/functional regulator procedures AND notifies AG no later than resident notice; HIPAA/HITECH similar	Offer 24 months of free identity theft prevention services for SSN/TIN breaches.	2026-09-30
Delaware DE	6 Del. C. § 12B-101 et seq.	60 calendar days Statute summary Without unreasonable delay, no later than 60 days after determination of breach	determination of the breach	Recipient Attorney General Threshold: More than 500 residents Timing: No later than notice to residents Statute summary Yes - if more than 500 DE residents No later than the time notice is provided to residents (within 60 days if late-identified residents/no substitute notice)	None Statute summary None	Yes Detail Yes - after appropriate investigation; no documentation/AG filing requirement	Yes but narrow - HIPAA/GLBA regulated entity following regulator procedures deemed compliant only with 60-day timing (§12B-103(b) as amended by HB 381, eff 9/2/2026)	HB 381 (85 Del. Laws c. 464, eff. 9/2/2026): HIPAA/GLBA regulated entities are deemed compliant only with the 60-day timing rule; AG notice and SSN credit monitoring still apply. 1 year of free credit monitoring if SSNs were breached.	2026-09-30
District of Columbia DC Verify with counsel Verify with counsel: private right of action: CPPA private-action section (28-3905(k)) was not separately fetched.	D.C. Code § 28-3851 et seq.	Most expedient time possible Statute summary Most expedient time possible, without unreasonable delay	No fixed day count	Recipient Office of the Attorney General Threshold: 50 or more residents Timing: No later than notice to residents Statute summary Yes - if breach affects 50 or more DC residents (written notice to OAG) Most expedient manner possible, without unreasonable delay, and no later than when notice is provided to residents	More than 1,000 Statute summary More than 1,000 persons	Yes Detail Yes - requires reasonable investigation and consultation with OAG before concluding no likely harm	Yes - GLBA Title V / HIPAA procedures deemed compliant, but OAG notice still required	OAG if 50 or more DC residents, no later than resident notice. A no-harm conclusion requires a reasonable investigation and consultation with OAG. Credit bureau notice (>1,000) does not apply to a person required to notify credit bureaus under GLBA Title V (28-3852(c)).	2026-09-30
Florida FL	Fla. Stat. § 501.171	30 calendar days Statute summary Without unreasonable delay, no later than 30 days after determination of breach (+15 days if good cause given in writing to Dept. of Legal Affairs)	determination of the breach	Recipient Dept. of Legal Affairs (Attorney General) Threshold: 500 or more residents Timing: No later than 30 days after determination (no extension) Statute summary Yes - Dept. of Legal Affairs (AG) if 500 or more FL individuals As expeditiously as practicable, no later than 30 days after determination of the breach or reason to believe a breach occurred; no extension (the 15-day good-cause extension in 501.171(3)(a) applies only to notice to individuals under subsection (4))	More than 1,000 Statute summary More than 1,000 individuals at a single time	Yes Detail Yes - after investigation and consultation with law enforcement; written determination retained 5 yrs and provided to Dept within 30 days	Yes - notice per primary/functional federal regulator rules deemed compliant if copy provided to Dept	Dept. of Legal Affairs notice (500 or more): no later than 30 days after determination, with no extension. Consumer notice can be extended 15 days for good cause provided in writing to the Dept. within 30 days after determination. A no-harm determination must be kept 5 years and provided to the Dept. within 30 days.	2026-09-30
Georgia GA	O.C.G.A. § 10-1-910 et seq.	Most expedient time possible Statute summary Most expedient time possible, without unreasonable delay	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary None N/A	More than 10,000 Statute summary More than 10,000 GA residents, without unreasonable delay	No Detail No	None in statute	Reviewer note: the notice duty applies to information brokers and government data collectors, not all businesses. CRAs if >10,000 Georgia residents.	2026-09-30
Hawaii HI	Haw. Rev. Stat. § 487N-1 et seq. (notice at § 487N-2)	Without unreasonable delay Statute summary Without unreasonable delay (consistent with law enforcement needs and scoping/restoring system)	No fixed day count	Recipient Office of Consumer Protection (Dept. of Commerce and Consumer Affairs) Threshold: More than 1,000 residents Timing: Without unreasonable delay Statute summary Yes - Office of Consumer Protection (DCCA), not AG, only if notice given to more than 1,000 persons at one time In writing, without unreasonable delay	More than 1,000 Statute summary More than 1,000 persons at one time (with OCP notice)	Yes Detail Yes - built into 'security breach' definition; no documentation requirement	Yes - financial institutions subject to federal Interagency Guidance or 12 CFR 748; HIPAA entities	Regulator is the Office of Consumer Protection (not the AG), only if >1,000 persons notified at one time.	2026-09-30
Idaho ID	Idaho Code §§ 28-51-104 to 28-51-107	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay (no fixed day count), after good-faith investigation finds misuse occurred or is reasonably likely	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice for private entities Statute summary No for private/commercial entities (AG notice optional). Public agencies only: notify AG, no numeric threshold N/A for private entities; public agencies within 24 hours of discovery	None Statute summary None	Yes Detail Yes: good-faith, prompt investigation; notify only if misuse occurred or reasonably likely. No documentation/AG filing requirement	Yes: entity regulated by state/federal law following its primary/functional regulator breach procedures deemed compliant	Private entities may notify the AG but are not required to (public agencies: within 24 hours).	2026-09-30
Illinois IL Verify with counsel Verify with counsel: penalties: ICFA civil-penalty amounts were not verified.	815 ILCS 530/1 et seq. (Personal Information Protection Act)	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay	No fixed day count	Recipient Attorney General Threshold: More than 500 residents Timing: No later than notice to consumers Statute summary Yes if notice required to more than 500 Illinois residents from a single breach (530/10(e)); HIPAA entities: copy to AG within 5 business days of notifying HHS (530/50). State agencies: >250 residents Most expedient time/without unreasonable delay, but no later than when consumers are notified; HIPAA entities within 5 business days of HHS notice	None Statute summary None for private data collectors (state agencies: >1,000)	No Detail No risk-of-harm exception	HIPAA deemed compliance only (530/50); no GLBA notice exemption	HIPAA covered entities/business associates: copy the AG within 5 business days of notifying HHS.	2026-09-30
Indiana IN	Ind. Code § 24-4.9-1-1 et seq.	45 calendar days Statute summary Without unreasonable delay, but not more than 45 days after discovery of the breach	discovery of the breach	Recipient Attorney General Threshold: No threshold Timing: Not more than 45 days after discovery Statute summary Yes, whenever individual disclosure is required (no threshold) Without unreasonable delay, but not more than 45 days after discovery	More than 1,000 Statute summary More than 1,000 consumers: notify each nationwide CRA	Yes Detail Yes: notice required if owner knows/should know acquisition resulted or could result in identity deception, identity theft, or fraud; no documentation requirement	Yes: GLBA/HIPAA/FCRA/PATRIOT/DPPA compliance plan requiring notice without unreasonable delay; financial institutions complying with federal interagency guidance exempt	The 45-day cap applies to the AG notice as well as individual notice (HEA 1351, eff. 7/1/2022).	2026-09-30
Iowa IA	Iowa Code §§ 715C.1-715C.2	Most expedient time possible Statute summary Most expeditious manner possible and without unreasonable delay (no fixed day count)	No fixed day count	Recipient Director, AG Consumer Protection Division Threshold: More than 500 residents Timing: Within 5 business days after consumer notice Statute summary Yes if notice required to more than 500 Iowa residents (to director of AG Consumer Protection Division, written) Within 5 business days after giving notice to any consumer	None Statute summary None	Yes Detail Yes: no notice if no reasonable likelihood of financial harm after investigation/consultation with law enforcement; must be documented in writing and retained 5 years	Yes: GLBA Title V compliant entities, HIPAA/HITECH compliant, and those following primary/functional federal regulator procedures are exempt	Written notice to the director of the AG Consumer Protection Division within 5 business days after notifying consumers (>500).	2026-09-30
Kansas KS	K.S.A. 50-7a01 to 50-7a02	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No AG notice required for private entities N/A	More than 1,000 Statute summary More than 1,000 consumers at one time: notify nationwide CRAs	Yes Detail Yes: good-faith investigation; notice only if misuse occurred or is reasonably likely; no documentation requirement	Yes: entities regulated by state/federal law following primary/functional regulator breach procedures deemed compliant	Insurers: the Insurance Commissioner has sole enforcement authority.	2026-09-30
Kentucky KY	KRS 365.732	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay (no fixed day count)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No AG notice required for private entities N/A	More than 1,000 Statute summary More than 1,000 persons at one time: notify nationwide CRAs	Yes Detail Yes (in breach definition): must actually cause or reasonably be believed to cause identity theft or fraud; no documentation requirement	Yes: statute does not apply to persons subject to GLBA Title V or HIPAA (no compliance condition)	Persons subject to GLBA Title V or HIPAA are fully exempt.	2026-09-30
Louisiana LA	La. R.S. 51:3071-3077; AG notice rule at La. Admin. Code tit. 16, Pt. III, §701	60 calendar days Statute summary Most expedient time possible, no later than 60 days from discovery (law-enforcement delay allowed; AG may grant extension on written request)	discovery of the breach	Recipient AG Consumer Protection Section Threshold: No threshold Timing: Received within 10 days after consumer notice Statute summary Yes - written notice to AG Consumer Protection Section whenever resident notice is required under 51:3074; NO 500-resident threshold; must include names of all affected LA residents Timely only if received within 10 days of distribution of notice to LA residents	None Statute summary None - no CRA notice requirement	Yes Detail Yes - no notice if reasonable investigation finds no reasonable likelihood of harm; written determination retained 5 years; provide to AG within 30 days of written request	Yes - financial institutions complying with Federal Interagency Guidance on Response Programs (Mar. 7, 2005, as revised) deemed compliant	AG notice for every notifiable breach (no 500 threshold) must include the names of all affected Louisiana residents and is timely only if received within 10 days after consumer notice; each late day can be a separate violation (up to $5,000).	2026-09-30
Maine ME	10 M.R.S. § 1346 et seq. (Notice of Risk to Personal Data Act); breach provisions §§1347-1349	30 calendar days Statute summary As expediently as possible, no more than 30 days after becoming aware of breach and identifying its scope (law-enforcement delay: within 7 business days after LE clears)	becoming aware of the breach and identifying its scope	Recipient Attorney General (or DPFR regulator if DPFR-regulated) Threshold: No threshold Timing: No statutory deadline (aligning with the 30-day consumer notice is prudent) Statute summary Yes - whenever resident notice is required: notify appropriate state regulator within Dept. of Professional & Financial Regulation, or AG if not DPFR-regulated No separate statutory deadline stated (§1348(5)); aligning with 30-day resident deadline is prudent practice	More than 1,000 Statute summary >1,000 persons at a single time - notify nationwide CRAs without unreasonable delay (date of breach, estimated number, notice date)	Yes Detail Yes for non-information-brokers: notice only if misuse occurred or reasonably possible after good-faith investigation; information brokers must notify on acquisition. No documentation/AG filing requirement	No GLBA-specific exemption; compliance with federal or state breach rules at least as protective as §1348 deemed compliance	DPFR-regulated entities notify their DPFR regulator instead of the AG. Statute sets no regulator deadline.	2026-09-30
Maryland MD	Md. Code Ann., Com. Law §§ 14-3501 to 14-3508	45 calendar days Statute summary As soon as reasonably practicable, not later than 45 days after business discovers or is notified of breach	discovery or notification of the breach	Recipient Attorney General Threshold: No threshold Timing: BEFORE notice to individuals Statute summary Yes - every breach requiring individual notice (no threshold); notice must include # of MD residents, description, steps taken, and sample notice PRIOR to giving notice to individuals	1,000 or more Statute summary 1,000 or more individuals - notify nationwide CRAs without unreasonable delay of timing, distribution, content	Yes Detail Yes - good-faith investigation; no notice if no likelihood of misuse; retain written records of determination 3 years	Yes - businesses/affiliates subject to and complying with GLBA 501(b), FACTA 216, Interagency Guidelines & Response Guidance, or HIPAA, or their primary/functional regulator's rules, deemed compliant	AG notice must be given BEFORE individual notice and include the number of Maryland residents, a description, steps taken and a sample notice.	2026-09-30
Massachusetts MA	M.G.L. ch. 93H, §§ 1-6 (incl. §3A credit monitoring); 201 CMR 17.00 (WISP)	Without unreasonable delay Statute summary As soon as practicable and without unreasonable delay; may not delay because total # affected not yet known	No fixed day count	Recipient Attorney General + Director, Office of Consumer Affairs and Business Regulation (OCABR) Threshold: No threshold Timing: As soon as practicable and without unreasonable delay Statute summary Yes - every breach: AG and Director of Office of Consumer Affairs & Business Regulation (OCABR); plus CRAs/state agencies OCABR identifies; must state whether a WISP is maintained As soon as practicable and without unreasonable delay (same standard as residents); send sample consumer notice to AG and OCABR	Conditional (see rule) Statute summary No numeric threshold - notify CRAs/state agencies identified by OCABR after it receives the breach notice	Yes Detail Built into breach definition (substantial risk of identity theft or fraud); no documentation/AG-filing requirement for no-notice decisions	Yes - persons maintaining breach procedures under federal law/guidance deemed compliant if residents notified per those procedures AND AG/OCABR notified	Notify the AG and OCABR for every breach; state whether you maintain a written information security program (WISP). OCABR identifies the CRAs/agencies to notify.	2026-09-30
Michigan MI	MCL 445.63 (definitions) and 445.72 (breach notice) of the Identity Theft Protection Act, 2004 PA 452	Without unreasonable delay Statute summary Without unreasonable delay (delay allowed to determine scope/restore integrity or for law enforcement)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No - Michigan has no AG/regulator breach notice requirement for private entities N/A - no AG notice requirement	More than 1,000 Statute summary >1,000 residents notified - notify nationwide CRAs without unreasonable delay (# and timing of notices); N/A to GLBA-subject entities	Yes Detail Yes - no notice if entity determines breach has not/is not likely to cause substantial loss/injury or ID theft (ordinarily prudent person standard); no documentation/filing requirement	Yes - financial institutions subject to Interagency Guidance (and NCUA) and affiliates deemed compliant; HIPAA-compliant entities deemed compliant	SB 360 (2025) would add AG notice at 100+ residents; not law as of 9/30/2026.	2026-09-30
Minnesota MN	Minn. Stat. § 325E.61 (single section; government entities under § 13.055)	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay (law-enforcement delay to date certain)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No - no AG/regulator notice for private entities; the >500 figure is the CRA-notice threshold N/A - no AG notice requirement (CRA notice within 48 hours if >500 persons)	More than 500 Statute summary >500 persons at one time - notify all nationwide CRAs within 48 hours	No Detail No - notice required if unencrypted PI acquired or reasonably believed acquired; no harm-analysis exception	Yes - GLBA financial institutions (15 USC 6809(3)) fully exempt from §325E.61	Notify all nationwide CRAs within 48 hours if >500 persons. GLBA financial institutions (15 USC 6809(3)) are fully exempt.	2026-09-30
Mississippi MS	Miss. Code Ann. § 75-24-29	Without unreasonable delay Statute summary Without unreasonable delay (subject to investigation/scope/restore integrity; law-enforcement delay)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No AG/regulator notice required N/A (no AG notice)	None Statute summary None	Yes Detail Yes - notice not required if, after appropriate investigation, breach will not likely result in harm; no documentation/AG filing requirement	Yes - entity following its primary or functional federal regulator's breach procedures deemed compliant (§ 75-24-29(7))	2025 bills to add AG notice (SB2046/HB731) died in committee.	2026-09-30
Missouri MO	Mo. Rev. Stat. § 407.1500	Without unreasonable delay Statute summary Without unreasonable delay	No fixed day count	Recipient Attorney General Threshold: More than 1,000 residents Timing: Without unreasonable delay Statute summary Only if notice given to >1,000 consumers at one time: notify AG (and nationwide CRAs) Without unreasonable delay (timing, distribution, content of notice)	More than 1,000 Statute summary >1,000 consumers notified at one time: all nationwide CRAs, without unreasonable delay	Yes Detail Yes - no notice if risk of identity theft/fraud not reasonably likely; determination must be documented in writing and kept 5 years	Yes - regulator procedures, Federal Interagency Guidance, NCUA 12 CFR 748, GLBA compliance deemed compliant	AG and CRAs only if >1,000 consumers notified at one time.	2026-09-30
Montana MT	Mont. Code Ann. § 30-14-1704 (part of § 30-14-1701 et seq.)	Without unreasonable delay Statute summary Without unreasonable delay	No fixed day count	Recipient AG Office of Consumer Protection Threshold: No threshold Timing: Simultaneously with notice to individuals Statute summary Yes - any entity required to notify must submit electronic copy of notice + date/method of distribution + number of MT residents notified to AG Office of Consumer Protection Simultaneously with notice to individuals	Conditional (see rule) Statute summary No numeric threshold; if notice suggests obtaining credit file, must coordinate timing/content/distribution with CRA	Yes Detail Effectively yes - breach definition requires loss/injury or reasonable belief thereof; no documentation/AG filing requirement	No GLBA/federal-regulator exemption (financial institutions are covered 'businesses'); only own-policy deemed compliance	Submit an electronic copy of the notice, date/method of distribution and number of Montana residents to the AG Office of Consumer Protection simultaneously with individual notice.	2026-09-30
Nebraska NE	Neb. Rev. Stat. § 87-801 et seq.	Most expedient time possible Statute summary As soon as possible and without unreasonable delay	No fixed day count	Recipient Attorney General Threshold: No threshold Timing: No later than notice to residents Statute summary Yes - whenever resident notice is required (after risk-of-harm investigation) Not later than the time notice is provided to residents	None Statute summary None	Yes Detail Yes - notice only if investigation finds unauthorized use has occurred or is reasonably likely; no documentation/AG filing requirement	Yes - regulated entity following primary/functional state or federal regulator procedures deemed compliant if it notifies residents and AG	AG no later than notice to residents.	2026-09-30
Nevada NV	Nev. Rev. Stat. § 603A.010 et seq. (notice: § 603A.220)	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary None N/A	More than 1,000 Statute summary >1,000 persons at one time: nationwide CRAs, without unreasonable delay (§ 603A.220(6))	No Detail No	Yes - GLBA-compliant data collector deemed compliant	CRAs if >1,000 persons at one time.	2026-09-30
New Hampshire NH	N.H. Rev. Stat. Ann. § 359-C:19 to :21	Most expedient time possible Statute summary As soon as possible / as quickly as possible after misuse determination	No fixed day count	Recipient Attorney General (or primary regulator for RSA 358-A:3, I entities) Threshold: No threshold Timing: No later than individual notice (the notice must state the anticipated date of individual notice) Statute summary Yes - all breaches requiring notice; entities subject to RSA 358-A:3, I notify their primary regulator instead of AG; include anticipated notice date and approx. # of NH residents No express deadline; notice must state anticipated date of individual notice (i.e., given before/with individual notice)	More than 1,000 Statute summary >1,000 consumers: nationwide CRAs without unreasonable delay; not applicable to GLBA-subject entities	Yes Detail Yes - notice unless determined misuse not reasonably likely; burden on entity to demonstrate compliance (§ 359-C:21, III); no AG filing of determination	Partial - 358-A:3,I entities following regulator procedures deemed compliant; GLBA entities exempt from CRA notice only	Entities subject to RSA 358-A:3, I notify their primary regulator instead of the AG.	2026-09-30
New Jersey NJ	N.J.S.A. 56:8-161 to -166 (breach notice at 56:8-163)	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay; no fixed day count	No fixed day count	Recipient Division of State Police Threshold: No threshold Timing: BEFORE notice to customers Statute summary Yes -- Division of State Police (Dept. of Law & Public Safety) for ALL breaches, BEFORE notifying customers. No separate AG notice. In advance of disclosure to customers	More than 1,000 Statute summary More than 1,000 persons at one time -> all nationwide CRAs, without unreasonable delay	Yes Detail Yes -- notice not required if misuse 'not reasonably possible'; determination documented in writing and retained 5 years (no AG filing)	No GLBA-specific exemption; entity with own consistent notification policy deemed compliant	Report to the Division of State Police BEFORE notifying customers. No separate AG notice in the statute.	2026-09-30
New Mexico NM	N.M. Stat. Ann. 57-12C-1 to -12 (Data Breach Notification Act, 2017)	45 calendar days Statute summary Most expedient time possible, but not later than 45 calendar days after discovery	discovery of the breach	Recipient Attorney General Threshold: More than 1,000 residents Timing: No later than 45 calendar days Statute summary Yes -- AG (and nationwide CRAs) only if >1,000 NM residents notified from a single breach Most expedient time possible, no later than 45 calendar days; include number of NM residents notified and a copy of the notice	More than 1,000 Statute summary More than 1,000 NM residents -> nationwide CRAs within 45 days	Yes Detail Yes -- no notice if investigation finds no significant risk of identity theft or fraud; no documentation/AG-filing requirement in statute	Yes -- Act does not apply to persons subject to GLBA or HIPAA (full exemption)	AG and CRAs if >1,000 within 45 days. Persons subject to GLBA or HIPAA are fully exempt.	2026-09-30
New York NY	N.Y. Gen. Bus. Law 899-aa (notice), 899-bb (safeguards); 23 NYCRR 500.17 for DFS-covered entities	30 calendar days Statute summary Most expedient time possible and without unreasonable delay, but no later than 30 days after discovery (law-enforcement delay only)	discovery of the breach	Recipient Attorney General + Dept. of State + Division of State Police (+ DFS if a Part 500 covered entity) Threshold: No threshold Timing: No statutory day count (DFS: 72 hours under 23 NYCRR 500.17 - see the incident notification deadlines page) Statute summary Yes -- for ANY NY resident notified: AG, Department of State, Division of State Police; plus DFS if a Part 500 covered entity. >500 residents inadvertent-disclosure determination to AG No statutory day count for AG/DOS/State Police (notice of timing, content, distribution, approx. number); DFS covered entities: 72 hrs under 500.17; inadvertent-disclosure determination to AG within 10 days if >500 residents	More than 5,000 Statute summary More than 5,000 NY residents at one time -> CRAs	Yes Detail Yes, limited: inadvertent disclosure by authorized persons; written determination kept 5 years; provided to AG within 10 days if >500 residents	Deemed compliance for individual notice under GLBA/HIPAA/Part 500/etc., but AG, DOS, State Police (and DFS) notice still required	30 days after discovery (L.2024 ch.647). Notify the AG, Dept. of State and State Police for any NY resident notified; DFS too if a 23 NYCRR 500 covered entity (72-hour clock; see the incident notification deadlines page). If relying on the inadvertent-disclosure no-harm determination for >500 residents, file it with the AG within 10 days. CRAs if >5,000.	2026-09-30
North Carolina NC	N.C. Gen. Stat. 75-60 to 75-66 (breach notice at 75-65)	Without unreasonable delay Statute summary Without unreasonable delay (law-enforcement/scope measures)	No fixed day count	Recipient AG Consumer Protection Division Threshold: No threshold Timing: Without unreasonable delay Statute summary Yes -- Consumer Protection Division of AG for EVERY breach where individual notice is given (no threshold) Without unreasonable delay	More than 1,000 Statute summary More than 1,000 persons at one time -> nationwide CRAs (and AG CPD) without unreasonable delay	Yes Detail Yes -- built into breach definition (illegal use reasonably likely / material risk of harm); no documentation or AG filing requirement	Yes -- financial institutions/credit unions subject to and complying with 2005 federal interagency guidance deemed compliant	AG Consumer Protection Division for every notifiable breach; CRAs if >1,000.	2026-09-30
North Dakota ND Verify with counsel Verify with counsel: private right of action: Untested for breach-notice claims.	N.D. Cent. Code 51-30-01 to 51-30-07	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay	No fixed day count	Recipient Attorney General Threshold: More than 250 residents Timing: Most expedient time possible, without unreasonable delay Statute summary Yes -- AG (mail or email) if breach exceeds 250 individuals Most expedient time possible and without unreasonable delay	None Statute summary None -- no CRA notice requirement	No Detail No -- no risk-of-harm exception	Yes -- deemed compliance for FIs/trust cos./credit unions complying with federal interagency guidance; HIPAA covered entities/BAs	AG if >250. DFI-regulated non-bank financial corporations also notify the DFI Commissioner for breaches of 500 or more consumers (HB 1127, eff. 8/1/2025).	2026-09-30
Ohio OH	Ohio Rev. Code 1349.19 (1349.191-.192 enforcement)	45 calendar days Statute summary Most expedient time possible but not later than 45 days after discovery	discovery of the breach	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No -- no AG/regulator notice requirement (only CRAs if >1,000) N/A -- no AG notice	More than 1,000 Statute summary More than 1,000 Ohio residents in a single breach -> nationwide CRAs without unreasonable delay	Yes Detail Yes -- notice only if material risk of identity theft or other fraud; no documentation/AG-filing requirement	Yes -- full exemption for financial institutions/trust cos./credit unions (and affiliates) required by federal law to notify and examined by functional regulator; HIPAA covered entities exempt	Financial institutions required by federal law to notify and examined by their functional regulator, and HIPAA covered entities, are exempt.	2026-09-30
Oklahoma OK	24 O.S. §§ 161-166 (Security Breach Notification Act, as amended by SB 626 (2025))	Without unreasonable delay Statute summary Without unreasonable delay (subject to law-enforcement delay/scope determination); only where breach causes or is reasonably believed to cause identity theft/fraud	No fixed day count	Recipient Attorney General Threshold: 500 or more residents Timing: No later than 60 days after notifying residents Statute summary Yes if 500+ OK residents affected in a single breach (1,000+ if breached entity is a credit bureau); fewer exempt Without unreasonable delay, but no later than 60 days after notifying residents; must include date, nature, PI types, # residents, est. monetary impact, safeguards used	None Statute summary None for general entities (SB 626's 1,000 figure is the AG-notice exemption for breached credit bureaus, not CRA notice)	Yes Detail Yes - notice only if breach causes or reasonably believed to cause identity theft/fraud; no documentation or AG-filing requirement for no-notify decision	Yes - GLBA/Interagency Guidance FIs and primary/functional federal regulator compliers deemed compliant, but only if they also give AG notice (SB 626); state-chartered FIs enforced by state regulator	SB 626 (eff. 1/1/2026): AG if 500+ residents (1,000+ if the breached entity is a credit bureau), no later than 60 days after notifying residents. GLBA/HIPAA deemed compliance applies only if the AG is also notified.	2026-09-30
Oregon OR	ORS 646A.600-646A.628 (notice at ORS 646A.604)	45 calendar days Statute summary Most expeditious manner, without unreasonable delay, but no later than 45 days after discovery/notification of breach	discovery or notification of the breach	Recipient Attorney General Threshold: More than 250 residents Timing: No separate AG clock; the 45-day outer limit is commonly read as applying - plan for it Statute summary Yes - AG (writing or electronic) if more than 250 OR consumers; vendors also notify AG if >250 or unknown count; even exempt (GLBA/HIPAA/federal) entities must send AG a copy of notice if >250 No separate AG deadline; 45-day outer limit in 646A.604(3) applies to 'notice of the breach' (read as applying to AG); exempt entities: 'within a reasonable time'	More than 1,000 Statute summary More than 1,000 consumers - notify nationwide CRAs without unreasonable delay (include police report #)	Yes Detail Yes - no consumer notice if reasonably determined unlikely to suffer harm after investigation/LE consultation; document in writing, retain 5 years	Yes - GLBA Title V, HIPAA/HITECH, and primary/functional federal regulator compliers exempt; must still send AG copy of notice if >250	Even GLBA/HIPAA/federal-regulator-exempt entities must send the AG a copy of the notice if >250.	2026-09-30
Pennsylvania PA	73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act, Act 94 of 2005, as amended by Act 151 of 2022 and Act 33 of 2024)	Without unreasonable delay Statute summary Without unreasonable delay following determination of breach (State agencies/contractors & counties/schools/municipalities: within 7 business days)	No fixed day count	Recipient Attorney General Threshold: More than 500 residents Timing: Concurrently with individual notice Statute summary Yes - AG if notice must go to more than 500 PA residents (entities subject to 40 Pa.C.S. Ch. 45 insurance data security exempt); State agencies notify AG concurrently regardless of count Concurrently with individual notice; must include org name/location, breach date, summary, total and PA affected counts	More than 500 Statute summary More than 500 persons at one time (lowered from 1,000 by Act 33 of 2024, eff. 9/26/2024); also 12 months free credit monitoring + credit report when SSN, bank account #, or DL/State ID exposed (Act 33 § 5.4)	Yes Detail Yes - embedded in breach definition (causes or reasonably believed to cause loss or injury); no documentation/AG-filing requirement	Yes - FIs complying with Interagency Guidance; entities complying with primary state or functional federal regulator; HIPAA covered entities/BAs deemed compliant	Act 33 of 2024 (eff. 9/26/2024): AG concurrently if >500; CRAs if >500. Offer 12 months of free credit monitoring and a credit report when SSN, bank account number or DL/state ID is exposed.	2026-09-30
Rhode Island RI	R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015)	45 calendar days Statute summary Most expedient time possible, no later than 45 calendar days after confirmation of breach (state/municipal agencies: 30 days); only if breach poses significant risk of identity theft	confirmation of the breach	Recipient Attorney General Threshold: More than 500 residents Timing: No fixed deadline; do not delay resident notice Statute summary Yes - AG (and major CRAs) if more than 500 RI residents notified No fixed deadline; notify AG as to timing/content/distribution/approx. number without delaying resident notice	More than 500 Statute summary More than 500 RI residents - notify major CRAs (same trigger as AG), without delaying resident notice	Yes Detail Yes - notice required only if breach poses significant risk of identity theft; no documentation/AG-filing requirement	Yes - primary/functional federal regulator procedures; FIs examined and found compliant with Interagency Guidance; HIPAA covered entities deemed compliant	45 calendar days for private persons (30 for state/municipal agencies). AG and CRAs if >500.	2026-09-30
South Carolina SC	S.C. Code Ann. § 39-1-90	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay (no fixed day count); only where illegal use occurred/reasonably likely or material risk of harm	No fixed day count	Recipient Dept. of Consumer Affairs, Consumer Protection Division Threshold: More than 1,000 residents Timing: Without unreasonable delay Statute summary Yes - Consumer Protection Division of the Dept. of Consumer Affairs (not AG) plus nationwide CRAs, if notice goes to more than 1,000 persons at one time Without unreasonable delay (DCA notice)	More than 1,000 Statute summary More than 1,000 persons at one time - notify nationwide CRAs and DCA Consumer Protection Division	Yes Detail Yes - notice only if illegal use occurred/reasonably likely or material risk of harm; no documentation requirement	Yes - banks/FIs subject to and compliant with GLBA exempt; Interagency Guidance compliance deemed compliant	Regulator is the Dept. of Consumer Affairs (not the AG), and CRAs, if >1,000.	2026-09-30
South Dakota SD	S.D. Codified Laws §§ 22-40-19 to 22-40-26	60 calendar days Statute summary No later than 60 days from discovery/notification (longer only for law-enforcement delay; then within 30 days after LE clears)	discovery or notification of the breach	Recipient Attorney General Threshold: More than 250 residents Timing: No statutory AG deadline (align with 60-day consumer notice) Statute summary Yes - AG (mail or email) if breach exceeds 250 SD residents; also AG notice required before relying on risk-of-harm exception (any size) No specific AG deadline in statute	Any breach Statute summary Any breach requiring resident notice - notify all nationwide CRAs without unreasonable delay (no threshold)	Yes Detail Yes - only after appropriate investigation AND notice to AG; written documentation retained 3 years	Yes - entities regulated by federal law (HIPAA, GLBA) following primary/functional federal regulator procedures deemed compliant	AG if >250. AG notice is also required before relying on the risk-of-harm exception (any size); keep the determination 3 years. CRAs for every notifiable breach.	2026-09-30
Tennessee TN Verify with counsel Verify with counsel: penalties: TCPA civil-penalty amounts (47-18-2105) were seen only in a search snippet, not statute text.	Tenn. Code Ann. § 47-18-2107 (enforcement §§ 47-18-2105, -2106)	45 calendar days Statute summary Immediately, but no later than 45 days from discovery/notification (LE delay: 45 days after LE clearance)	discovery or notification of the breach	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary None - statute has no AG/regulator notice requirement N/A - no AG notice	More than 1,000 Statute summary > 1,000 persons at one time -> all nationwide CRAs	No Detail No risk-of-harm analysis; notice triggered by breach of system security	Yes - full exemption for entities subject to GLBA Title V or HIPAA/HITECH	No AG notice (2018 HB2508 never enacted). Persons subject to GLBA Title V or HIPAA are exempt.	2026-09-30
Texas TX	Tex. Bus. & Com. Code § 521.053 (defs § 521.002; penalties § 521.151)	60 calendar days Statute summary Without unreasonable delay, no later than 60 days after determining the breach occurred	determination that the breach occurred	Recipient Attorney General (electronic form) Threshold: 250 or more residents Timing: No later than 30 days after determination Statute summary Yes - if breach involves at least 250 TX residents As soon as practicable, no later than 30 days after determining breach occurred; submitted electronically via AG website form	More than 10,000 Statute summary > 10,000 persons at one time -> nationwide CRAs, without unreasonable delay	No Detail No risk-of-harm analysis	No GLBA/federal-regulator exemption from § 521.053 (own-policy compliance safe harbor only)	AG via the AG electronic form if at least 250 Texans, no later than 30 days after determination (SB 768, eff. 9/1/2023). CRAs if >10,000.	2026-09-30
Utah UT	Utah Code §§ 13-44-101 to -301 (notice § 13-44-202)	Most expedient time possible Statute summary Most expedient time possible without unreasonable delay (no fixed day count), after investigation finds misuse occurred or reasonably likely	No fixed day count	Recipient Attorney General + Utah Cyber Center Threshold: 500 or more residents Timing: Most expedient time possible without unreasonable delay Statute summary Yes - AG AND Utah Cyber Center if misuse of PI of 500 or more UT residents has occurred or is reasonably likely No fixed deadline - same 'most expedient time possible without unreasonable delay' standard; must include breach/discovery dates, counts, PI types, description	1,000 or more Statute summary 1,000 or more UT residents (misuse likely) -> nationwide CRAs	Yes Detail Yes - mandatory good-faith prompt investigation; notice only if misuse for identity theft/fraud occurred or reasonably likely; no AG filing of no-harm determination	Yes - person regulated by state/federal law following primary regulator's breach procedures deemed compliant (§ 13-44-202(5)(c))	AG and Utah Cyber Center if 500 or more residents; CRAs if 1,000 or more.	2026-09-30
Vermont VT	9 V.S.A. § 2435 (defs § 2430)	45 calendar days Statute summary Most expedient time possible, no later than 45 days after discovery/notification	discovery or notification of the breach	Recipient Attorney General (or Dept. of Financial Regulation if DFR-regulated) Threshold: No threshold Timing: Preliminary notice within 14 business days of discovery or at consumer notice, whichever is sooner Statute summary Yes - all breaches; to AG, or to Dept. of Financial Regulation (DFR) if data collector is regulated by DFR under Title 8/Title 9 Preliminary notice within 14 BUSINESS days of discovery or at consumer notice, whichever sooner (pre-sworn policy filers: before consumer notice); plus count + copy of consumer notice when consumers notified	More than 1,000 Statute summary > 1,000 consumers at one time -> nationwide CRAs (not applicable to DFR Title 8 licensees)	Yes Detail Yes - may skip notice if misuse not reasonably possible, but must file determination + detailed explanation with AG/DFR	Yes - FIs subject to 2005 federal Interagency Guidance (or NCUA guidance) exempt; DFR-regulated FIs must notify DFR ASAP	Preliminary notice to the AG (or DFR if DFR-regulated) within 14 business days of discovery or at consumer notice, whichever is sooner, then a second filing with the count and a copy of the consumer notice. A no-harm determination must be filed with the AG/DFR.	2026-09-30
Virginia VA	Va. Code § 18.2-186.6	Without unreasonable delay Statute summary Without unreasonable delay (reasonable delay to determine scope/restore; LE delay)	No fixed day count	Recipient Attorney General Threshold: No threshold Timing: Without unreasonable delay Statute summary Yes - AG must be notified of EVERY notifiable breach (§ 18.2-186.6(B)); additional AG + CRA notice of timing/distribution/content if > 1,000 residents notified at one time (E) Without unreasonable delay (same as residents); AG only - no State Police requirement	More than 1,000 Statute summary > 1,000 persons at one time -> AG and nationwide CRAs	Yes Detail Yes - notice only if breach causes or reasonably believed to cause identity theft/fraud; no AG filing of no-harm determination	Yes - GLBA Title V entities with compliant procedures deemed compliant; primary/functional regulator compliance also deemed compliant	AG for every notifiable breach; an additional AG and CRA notice if >1,000 at one time.	2026-09-30
Washington WA	RCW 19.255.005-.040 (chapter 19.255 RCW); last amended 2019 c 241 (HB 1071, eff. 3/1/2020); no 2023-2026 amendments	30 calendar days Statute summary Most expedient time, no more than 30 calendar days after discovery (law-enforcement delay allowed)	discovery of the breach	Recipient Attorney General Threshold: More than 500 residents Timing: No more than 30 days after discovery Statute summary Yes - AG if notifying >500 WA residents from a single breach; HIPAA covered entities and federally regulated banks/CUs must also notify AG No more than 30 days after discovery; must update AG if info unknown at time of notice	None Statute summary None (notice must list CRA contact numbers, but no CRA notification duty)	Yes Detail Yes - no notice if breach not reasonably likely to subject consumers to risk of harm; no documentation/AG filing requirement	Yes - federally regulated banks/CUs complying with interagency guidance and 12 CFR 30/208/225/364/748 deemed compliant; HIPAA covered entities too; both must notify AG	AG if >500, within 30 days after discovery; update the AG if information was unknown at the time of notice.	2026-09-30
West Virginia WV	W. Va. Code §§ 46A-2A-101 to -105; enacted 2008 SB 340; no later amendments	Without unreasonable delay Statute summary Without unreasonable delay (law-enforcement delay allowed)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No - statute has no AG/regulator notice requirement (CRA notice only if >1,000 persons) N/A	More than 1,000 Statute summary More than 1,000 persons: notify nationwide CRAs of timing, distribution, content (GLBA-subject entities exempt)	Yes Detail Yes - notice only if entity reasonably believes breach caused/will cause ID theft or fraud; no documentation requirement	Yes - FIs complying with Federal Interagency Guidance deemed compliant; any entity complying with primary/functional regulator's rules deemed compliant	CRAs if >1,000.	2026-09-30
Wisconsin WI	Wis. Stat. § 134.98; last amended 2007 Act 97; statutes current through 2025 Act 247 (Sept 2026)	45 calendar days Statute summary Reasonable time, not to exceed 45 days after entity learns of acquisition	learning of the acquisition	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No AG notice (CRA notice if 1,000+ individuals) N/A	1,000 or more Statute summary 1,000+ individuals: notify all nationwide CRAs of timing, distribution, content	Yes Detail Yes - no notice if acquisition does not create material risk of ID theft or fraud; no documentation requirement	Yes - entities subject to GLBA (15 USC 6801-6827) or HIPAA are exempt	CRAs if 1,000 or more individuals.	2026-09-30
Wyoming WY	Wyo. Stat. §§ 40-12-501 to -502 (PI elements by reference to § 6-3-901(b)); last substantive amendment 2015 (Laws 2015 ch. 63, SF 35/36)	Most expedient time possible Statute summary Most expedient time, without unreasonable delay, after good-faith investigation (law-enforcement delay)	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary No - no AG or regulator notice requirement (AG enforcement only) N/A	None Statute summary None	Yes Detail Yes - mandatory good-faith investigation; notice only if misuse occurred or reasonably likely; no documentation/AG filing	Yes - GLBA FIs / federal CUs following 12 CFR 364 App. B / 748 App. B; HIPAA covered entities and BAs	No regulator notice; AG enforces.	2026-09-30
Puerto Rico PR Verify with counsel Verify with counsel: Statute text from a 2017 LexisNexis printout (code mirror); amendments after 2017 not checked.	10 L.P.R.A. §§ 4051-4055 (Citizen Information on Data Banks Security Act, Act 111-2005, as amended by Act 97-2008)	Most expedient time possible Statute summary As expeditiously as possible, considering law-enforcement needs and measures to restore system security (§ 4052)	No fixed day count	Recipient Dept. of Consumer Affairs (DACO) Threshold: No threshold Timing: Within a non-extendable 10 days after the breach is detected Statute summary Yes - Dept. of Consumer Affairs (DACO) for any breach requiring notice (§ 4052); government agencies notify the Citizen's Advocate Office (§ 4054a) Within a non-extendable term of 10 days after the breach is detected; DACO makes a public announcement within 24 hours (§ 4052)	None Statute summary None in statute	No Detail No - notice on detected unauthorized access to unencrypted files	No GLBA-specific exemption; existing institutional policies with equal or better protection are not prejudiced (§ 4054)	Notify DACO within a non-extendable 10 days after the breach is detected; DACO announces it publicly within 24 hours. Government agencies notify the Citizen's Advocate Office instead.	2026-09-30
Guam GU Verify with counsel Verify with counsel: Statute text from the Guam Compiler of Laws chapter dated 2009; later amendments not checked.	9 GCA §§ 48.10-48.80 (added by P.L. 30-004, 2009)	Without unreasonable delay Statute summary Without unreasonable delay (law-enforcement delay and scope/restore measures allowed) (§ 48.30(a),(d))	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary None N/A	None Statute summary None	Yes Detail Yes - built into breach definition (identity theft or other fraud caused or reasonably believed)	Yes - FIs complying with the Federal Interagency Guidance; entities complying with their primary/functional federal regulator (§ 48.40(b))	AG has exclusive enforcement (actual damages or civil penalty up to $150,000 per breach or series of similar breaches).	2026-09-30
U.S. Virgin Islands VI Verify with counsel Verify with counsel: Statute text from a code mirror (official/Justia text blocked); amendments not checked.	14 V.I.C. §§ 2208 (agencies), 2209 (persons/businesses), 2210-2212 (Act 6789, 2005)	Most expedient time possible Statute summary Most expedient time possible and without unreasonable delay (law-enforcement delay and scope/restore measures allowed) (§ 2209(a))	No fixed day count	Recipient None Threshold: No regulator notice Timing: No regulator notice Statute summary None N/A	None Statute summary None	No Detail No	No GLBA exemption; own-policy deemed compliance only (§ 2209(h))	Customers injured by a violation may sue for damages (14 V.I.C. 2211).	2026-09-30

Track these deadlines per incident in the Incident Response & Breach Notification Kit: its Breach Notification tab works out consumer and regulator due dates for each affected state from this same dataset.

◆ How to use this

Read the row, then read the statute.

List every state, district or territory where affected individuals live. Each law protects its own residents, so one incident can trigger several of them.
Record the date of the event in "Clock starts" for each state (discovery, determination, or notification by a vendor). Fixed day counts run from that event.
Count affected residents per state and apply each threshold exactly as written: "more than 500" and "500 or more" differ at exactly 500.
If you are a bank, credit union or other GLBA-regulated company, read the GLBA column before assuming you are exempt; many states still require the attorney general copy.
Treat rows marked "Verify with counsel" as unconfirmed on the named point, and confirm every external notice with counsel before it goes out.
Download the CSV or JSON to build your own tracker. The JSON includes the source URL behind each field.

Methodology

Each row was checked against the statute or attorney general text on September 30, 2026: 45 against official legislature or attorney general sources, 8 against a current code mirror and 1 against both. The JSON download includes the source URL behind each field. Thresholds count residents of that jurisdiction.

Not legal advice

This is a reference summary for risk and compliance teams, not legal advice. Laws change and how they apply depends on your facts. Confirm each obligation against the cited text and with counsel before you rely on a deadline.

◆ FAQ

Common questions.

How many states have a fixed deadline for data breach notification?

22 of 54 jurisdictions set a fixed number of days to notify affected residents: 30 calendar days in 6 (California, Colorado, Florida, Maine, New York and Washington); 45 calendar days in 11 (Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont and Wisconsin); 60 calendar days in 5 (Connecticut, Delaware, Louisiana, South Dakota and Texas). The other 32 require notice in the most expedient time possible (20) or without unreasonable delay (12). Last verified September 30, 2026.

Which states require you to notify the attorney general or a regulator before notifying consumers?

Maryland (Attorney General: "BEFORE notice to individuals") and New Jersey (Division of State Police: "BEFORE notice to customers"). 8 more require regulator notice no later than consumer notice (Connecticut, Delaware, District of Columbia, Illinois, Montana, Nebraska, New Hampshire and Pennsylvania), and 4 set a deadline after consumer notice: California ("Within 15 calendar days after notifying consumers"), Iowa ("Within 5 business days after consumer notice"), Louisiana ("Received within 10 days after consumer notice") and Oklahoma ("No later than 60 days after notifying residents").

Does "more than 500" mean the same thing as "500 or more"?

No. A breach affecting exactly 500 residents triggers a "500 or more" rule but not a "more than 500" rule. Of the 23 jurisdictions with a numeric regulator-notice threshold, 17 use "more than" and 6 use "or more" / "at least" (Colorado, District of Columbia, Florida, Oklahoma, Texas and Utah). This chart keeps each statute's exact operator.

Are banks and other GLBA-regulated companies exempt from state breach notification laws?

Usually not completely. In 42 of 54 jurisdictions the statute treats an entity that follows GLBA, the federal Interagency Guidance or its primary regulator's breach rules as compliant, often with conditions such as still notifying the attorney general. In the other 12 (Alaska, California, Georgia, Illinois, Maine, Montana, New Hampshire, New Jersey, New York, Texas, Puerto Rico and U.S. Virgin Islands) there is no full GLBA deemed-compliance rule or it is limited. For example, California: "No GLBA exemption; HIPAA covered entities deemed compliant with notice-content rules only if HITECH § 13402(f) followed". Texas: "No GLBA/federal-regulator exemption from § 521.053 (own-policy compliance safe harbor only)".

How current is this chart?

Every row was checked against the statute or attorney general text on September 30, 2026, with a source link per row (and per field in the JSON download). 7 rows carry a "Verify with counsel" flag where a point could not be confirmed from primary text: District of Columbia, Illinois, North Dakota, Tennessee, Puerto Rico, Guam and U.S. Virgin Islands.

◆ Sources

Primary sources.

The statute text checked for each of the 54 jurisdictions. Field-level source URLs are in the JSON download.

Data: CSV · JSON. Free to reuse under CC BY 4.0 with attribution to RiskTemplates and a link to this page. Last verified September 30, 2026.