If someone breaks into your business’s website, email or computers and takes customer information, state law decides who you have to tell and how fast. All 50 states and Washington, DC have a data breach notification law. Most apply to businesses of every size, including one-person shops.
This guide follows our page on the October 2026 PHP security flaw, which put many small business websites at risk. Below is each state’s deadline for notifying residents and whether you also have to notify the state attorney general.
What these laws require
The basic rule is the same everywhere. If a business learns that someone without permission got residents’ personal information, it has to tell those people. In most states, “personal information” means a name together with a Social Security number, driver’s license number, or a financial account or card number with the code needed to use it. Many states add online usernames and passwords, medical information and biometric data such as fingerprints.
What changes from state to state:
- The deadline. Some states set a fixed number of days, from 30 to 60. Others say “without unreasonable delay,” which means as soon as you reasonably can after you figure out what happened.
- Who else you tell. Many states require notice to the attorney general, sometimes only when a certain number of residents are affected.
- Encrypted data. In nearly every state, you don’t have to notify anyone if the stolen data was encrypted and the key wasn’t taken.
You follow the law of the state where each affected person lives. A Florida shop with online customers in Texas and New York has to meet the Texas and New York rules for those customers.
Breach notice deadlines and attorney general rules by state
“As soon as possible” means the law says “without unreasonable delay” or “most expedient time possible” and sets no fixed number of days. Day counts start when the business discovers or confirms the breach. Thresholds are counts of affected residents of that state. Many states also require notice to the credit reporting companies for large breaches; that isn’t shown here.
| State | Deadline to notify residents | Notify attorney general or state regulator? | Law |
|---|---|---|---|
| Alabama | 45 days | Yes, over 1,000 | Ala. Code 8-38-1 to 12 |
| Alaska | As soon as possible | Only if you decide notice isn’t needed (written finding) | Alaska Stat. 45.48.010-090 |
| Arizona | 45 days | Yes, over 1,000 | A.R.S. 18-551, 18-552 |
| Arkansas | Check statute | Yes, over 1,000 (timing: Check statute) | Ark. Code 4-110-101 to 108 |
| California | 30 days | Yes, over 500 (within 15 days after residents) | Cal. Civ. Code 1798.82 |
| Colorado | 30 days | Yes, 500 or more | C.R.S. 6-1-716 |
| Connecticut | 60 days | Yes, any breach | Conn. Gen. Stat. 36a-701b |
| Delaware | 60 days | Yes, over 500 | 6 Del. C. 12B-101 to 104 |
| District of Columbia | As soon as possible | Yes, 50 or more | D.C. Code 28-3851 to 3853 |
| Florida | 30 days | Yes, 500 or more | Fla. Stat. 501.171 |
| Georgia | Check statute | Check statute | O.C.G.A. 10-1-910 to 912 |
| Hawaii | As soon as possible | Yes, over 1,000 (Office of Consumer Protection) | Haw. Rev. Stat. 487N |
| Idaho | As soon as possible | No (applies to state agencies only) | Idaho Code 28-51-104 to 107 |
| Illinois | As soon as possible | Yes, over 500 | 815 ILCS 530 |
| Indiana | 45 days | Yes, any breach | Ind. Code 24-4.9 |
| Iowa | As soon as possible | Yes, over 500 (within 5 business days) | Iowa Code 715C |
| Kansas | As soon as possible | No | K.S.A. 50-7a01 to 7a04 |
| Kentucky | As soon as possible | No | KRS 365.732 |
| Louisiana | 60 days | Yes, any breach | La. R.S. 51:3071 to 3077 |
| Maine | 30 days | Yes, any breach | 10 M.R.S. 1346 to 1350-B |
| Maryland | 45 days | Yes, any breach (before residents) | Md. Code Com. Law 14-3501 to 3508 |
| Massachusetts | As soon as possible | Yes, any breach (AG and OCABR) | M.G.L. c. 93H |
| Michigan | As soon as possible | No | MCL 445.72 |
| Minnesota | As soon as possible | No | Minn. Stat. 325E.61 |
| Mississippi | Check statute | Check statute | Miss. Code 75-24-29 |
| Missouri | As soon as possible | Yes, over 1,000 | Mo. Rev. Stat. 407.1500 |
| Montana | As soon as possible | Yes, any breach | Mont. Code 30-14-1704 |
| Nebraska | As soon as possible | Yes, any breach | Neb. Rev. Stat. 87-801 to 808 |
| Nevada | As soon as possible | No | NRS 603A.010 to 290 |
| New Hampshire | As soon as possible | Yes, any breach | RSA 359-C:19 to 21 |
| New Jersey | As soon as possible | Yes, State Police before residents | N.J.S.A. 56:8-161 to 166 |
| New Mexico | 45 days | Yes, over 1,000 | N.M. Stat. 57-12C |
| New York | Check statute | Yes, any breach (AG, Dept. of State, State Police) | N.Y. Gen. Bus. Law 899-aa |
| North Carolina | As soon as possible | Yes, any breach | N.C.G.S. 75-61, 75-65 |
| North Dakota | As soon as possible | Yes, over 250 | N.D.C.C. 51-30 |
| Ohio | 45 days | No | Ohio Rev. Code 1349.19 |
| Oklahoma | As soon as possible | Yes, 500 or more (within 60 days after residents) | 24 O.S. 161-166 |
| Oregon | 45 days | Yes, over 250 | ORS 646A.600 to 628 |
| Pennsylvania | Check statute | Check statute | 73 P.S. 2301 to 2330 |
| Rhode Island | 45 days | Yes, over 500 | R.I. Gen. Laws 11-49.3 |
| South Carolina | As soon as possible | Yes, over 1,000 (Dept. of Consumer Affairs) | S.C. Code 39-1-90 |
| South Dakota | 60 days | Yes, over 250 | SDCL 22-40-19 to 26 |
| Tennessee | 45 days | Check statute | Tenn. Code 47-18-2107 |
| Texas | Check statute | Yes, 250 or more (within 30 days) | Tex. Bus. & Com. Code 521.053 |
| Utah | As soon as possible | Yes, 500 or more (AG and Utah Cyber Center) | Utah Code 13-44-202 |
| Vermont | 45 days | Yes, any breach (within 14 business days) | 9 V.S.A. 2435 |
| Virginia | As soon as possible | Yes, any breach | Va. Code 18.2-186.6 |
| Washington | 30 days | Yes, over 500 | RCW 19.255.010 |
| West Virginia | As soon as possible | No | W. Va. Code 46A-2A-101 to 105 |
| Wisconsin | 45 days | No | Wis. Stat. 134.98 |
| Wyoming | As soon as possible | No | Wyo. Stat. 40-12-501 to 502 |
A dash means we couldn’t confirm the current rule from the official source, so we left it out rather than guess. Laws change often. Check your state’s current statute or attorney general website before you act.
States that reward good security: safe harbor laws
A handful of states give businesses a defense in some breach lawsuits if they had a written security program that follows a recognized standard, such as the NIST Cybersecurity Framework or the CIS Controls:
- Ohio was first, with its Data Protection Act in 2018.
- Utah passed the Cybersecurity Affirmative Defense Act in 2021.
- Connecticut passed a 2021 law that bars punitive damages in some breach cases when the business followed a recognized framework.
- Iowa passed a similar law in 2023.
None of these laws remove the duty to notify people. They only help if you’re sued. Even small businesses can use the free CIS Controls checklist as a starting point.
What to do after a breach
- Stop the damage. Change passwords, turn on two-step login, and ask your web host or IT person to lock down the affected system. Don’t wipe anything yet, because you may need it to work out what was taken.
- Call your insurer early if you have cyber insurance. Many policies require prompt notice and have a list of approved lawyers and investigators.
- Find out what was taken and whose it was. You need to know which kinds of data were exposed and which states the affected people live in.
- Check each state’s rules using the table above, and meet the shortest deadline that applies.
- Send the notices. Most states require a letter or email saying what happened, what information was involved, what you’re doing about it, and how people can protect themselves, including credit freeze information.
- Notify the attorney general where required. Many attorney general offices have an online breach reporting form.
- Fix what caused it, and keep records of everything you did.
If you take card payments, your card processor also has rules about reporting a breach. If you’re in a regulated field such as health care, federal rules like HIPAA may add more steps.
What cyber insurance covers
Cyber insurance is separate from general liability insurance, and a general liability policy usually doesn’t cover data breaches. A cyber policy commonly helps pay for:
- Notification letters and call centers
- Credit monitoring for affected customers
- Forensic investigators to find out what happened
- Lawyers to handle notice rules in each state
- Lawsuits and regulator fines where the law allows them to be insured
- Lost income while your systems are down
Policies differ, so read the coverage list and exclusions before you buy. Simply Business lets small businesses compare cyber liability quotes from several insurers online.
For other insurance and legal rules by state, see our guides to insurance requirements for commercial and government contracts and AI business scams.
Frequently asked questions
Does a data breach law apply to my small business?
Usually yes. Every state, plus DC, has a breach notice law, and most apply to any business that keeps personal information about state residents. We did not find a general small-business exemption in these laws.
What counts as personal information?
In most states it’s a person’s name together with a Social Security number, driver’s license number, or a bank or card number with the code needed to use it. Many states also include online login details, medical or health insurance information, and biometric data.
Do I have to tell people if the stolen data was encrypted?
In nearly every state, no, as long as the encryption key wasn’t taken too. That’s why encrypting customer data is one of the cheapest ways to cut your risk.
Which state’s law do I follow if my customers live in different states?
You follow the law of each state where an affected person lives, not just the state where your business is. If you have customers in five states, you check five laws.
What is a cybersecurity safe harbor law?
A few states, including Ohio, Utah, Connecticut and Iowa, give businesses a legal defense in some data breach lawsuits if they had a written security program that follows a recognized framework, such as the NIST Cybersecurity Framework or the CIS Controls. They don’t remove the duty to notify people.
Does cyber insurance pay for breach notices?
Many cyber policies cover notification letters, credit monitoring, forensic investigators, legal help and some lawsuits. What is covered depends on the policy, so read the coverage list before you buy.
Sources: each state’s data breach statute as cited in the table, and state attorney general websites. National Conference of State Legislatures security breach notification law list used as a cross-check only. Last checked October 22, 2026.