Data Breach Notification Laws: Deadlines, Notices, and Penalties

Data breach notification laws in the United States are a patchwork: no single federal statute covers every industry, so an organization’s obligations depend on the type of data it holds, its regulated sector, and the states where affected individuals live. Federal deadlines run from as short as four business days for public companies filing with the SEC to 60 calendar days under HIPAA and the FTC’s Health Breach Notification Rule, and every state layers its own timeline on top. Penalties for missing those deadlines can reach millions of dollars, and in some cases carry criminal exposure.¹

How the Federal and State Rules Fit Together

At the federal level, the Federal Trade Commission enforces Section 5 of the FTC Act, which prohibits unfair or deceptive practices. A company that promises to safeguard personal information and then fails to do so can face an FTC enforcement action on that basis alone.² Beyond that general authority, separate federal rules apply to healthcare providers, financial institutions, telecommunications carriers, health app developers, and publicly traded companies.

All 50 states have their own breach notification statutes, and they differ on how they define personal information, how quickly notice must go out, and what the notice must say. Roughly 20 states set numeric deadlines between 30 and 60 days; the rest use open-ended language like “without unreasonable delay.” A business holding data on residents of multiple states must comply with each state’s law at once, which usually means working to the strictest applicable rule.

Industry-Specific Federal Requirements

Healthcare Under HIPAA

The HIPAA Breach Notification Rule applies to covered entities (health plans, providers, clearinghouses) and their business associates when unsecured protected health information is compromised. Individual notice must go out no later than 60 calendar days after discovery.³ Discovery is defined broadly: a breach counts as discovered the first day any employee or agent knows about it, or should have known about it through reasonable diligence.⁴

When a breach affects more than 500 residents of a single state, the covered entity must also notify prominent media outlets serving that area and report the incident to the Secretary of Health and Human Services.⁴ Smaller breaches still get reported to HHS, but they can go in an annual log. A business associate that discovers a breach notifies the covered entity, which handles individual notice.

Financial Institutions Under the Safeguards Rule

The Gramm-Leach-Bliley Act requires financial institutions to protect nonpublic personal information and disclose their information-sharing practices.⁵ The FTC’s amended Safeguards Rule, effective in 2024, adds a concrete reporting obligation: financial institutions must notify the FTC within 30 days of discovering an event involving the unencrypted information of at least 500 consumers.⁶

A reportable event is any unauthorized acquisition of unencrypted customer information. If the encryption key itself was accessed by an unauthorized person, the data is treated as unencrypted.⁷ The rule applies well beyond traditional banks, reaching mortgage brokers, auto dealers that arrange financing, payday lenders, and tax preparation firms.

Telecommunications Carriers Under FCC Rules

Telecom carriers must notify the FCC, the FBI, and the U.S. Secret Service of a reportable breach within seven business days of confirming the incident. Customer notification must follow within 30 days after the carrier reasonably determines a breach occurred.⁸ For smaller breaches affecting fewer than 500 customers where no harm is likely, carriers can file a consolidated annual summary with the agencies by February 1 of the following year.

Health Apps Under the FTC Health Breach Notification Rule

Businesses that handle health information but fall outside HIPAA (fitness trackers, period-tracking apps, personal health record platforms) are typically subject to the FTC’s Health Breach Notification Rule. Vendors of personal health records, related entities, and their service providers must notify affected individuals within 60 calendar days of discovering a breach. When 500 or more people are affected, the FTC and prominent media outlets must be notified in the same window.⁹ Violations carry civil penalties up to $53,088 per incident.

Public Companies Under SEC Rules

A publicly traded company that experiences a material cybersecurity incident must file a Form 8-K within four business days of determining the incident is material. The filing must describe the nature, scope, and timing of the incident along with its actual or reasonably likely material impact on the company’s financial condition and operations.¹⁰

The materiality analysis cannot rest on financial metrics alone. The SEC has said companies must weigh qualitative factors like reputational damage, loss of customer relationships, and the likelihood of regulatory investigations or litigation.¹¹ If a breach is clearly significant but its full impact has not yet been assessed, the initial 8-K still has to be filed on time, with an amendment later once more is known.

Public companies also describe their cybersecurity risk management processes and governance structures in their annual reports, including who on the management team is responsible for cybersecurity, whether third-party assessors are engaged, and how the board exercises oversight.¹² The Attorney General can request a delay of up to 120 days if disclosure would threaten national security, with further extensions available through SEC order in extraordinary circumstances.¹⁰

What Counts as a Breach

The threshold question is whether an event qualifies as a breach under the applicable law. At its core, a breach is an incident that compromises the security or confidentiality of personal information. Most laws distinguish between unauthorized access (someone views the data) and unauthorized acquisition (someone actually takes it). The acquisition standard is stricter and, under the Safeguards Rule, triggers notification only when someone obtains unencrypted information without authorization.⁷

What counts as “personal information” also varies. At a minimum, it usually means a person’s name combined with a Social Security number, driver’s license number, or financial account details. Many jurisdictions extend the definition to biometric data, login credentials paired with an email address, and medical information. Forensic investigators often have to determine whether data was actually exfiltrated or merely exposed, and that technical finding drives the legal answer.

The Encryption Safe Harbor

Encrypting data properly before an incident is the most effective way to avoid notification obligations. Nearly every framework contains a safe harbor for encrypted information. Under HIPAA, protected health information is considered “secured” (and exempt from notification) if it was encrypted consistent with National Institute of Standards and Technology guidelines and the decryption key was not compromised.¹³ The key must be stored separately from the encrypted data for the protection to hold.

The Safeguards Rule similarly defines a reportable event as the unauthorized acquisition of “unencrypted” customer information, so properly encrypted data that stays encrypted does not trigger reporting.⁷ The FCC offers a parallel safe harbor for telecom carriers: customer notification is not required when a breach involves only encrypted data and the carrier has definitive evidence that the encryption key was not accessed.⁸

Some jurisdictions also recognize a risk-of-harm exemption: if a documented internal investigation concludes that the breach is unlikely to result in financial harm or identity theft, notification may not be required. An organization that relies on this exemption and turns out to be wrong faces significantly harsher consequences than one that notified in the first place.

Deadlines at a Glance

Every law sets its own clock. The federal timelines are:

SEC (public companies): Four business days after determining an incident is material.¹⁰
FCC (telecom carriers): Seven business days to notify federal agencies; 30 days to notify customers.⁸
FTC Safeguards Rule (financial institutions): 30 days to notify the FTC when 500 or more consumers are affected.⁶
HIPAA (healthcare): 60 calendar days to notify affected individuals.³
FTC Health Breach Notification Rule (health apps): 60 calendar days to notify affected individuals and the FTC.⁹

State deadlines sit on top. About 20 states impose fixed numeric deadlines, most commonly 30, 45, or 60 days; the rest use language like “without unreasonable delay” or “as expediently as possible.” When deadlines conflict, working to the shortest applicable one is the safer default.

Law enforcement can request temporary delays if immediate notice would interfere with a criminal investigation. Under the Safeguards Rule, an initial 30-day hold is available, extendable by up to 60 additional days with written justification.⁶ Under SEC rules, the Attorney General can request delays of up to 120 days on national security grounds, with further extensions possible through a formal SEC order.¹⁰ Once any hold is lifted, the clock resumes.

Who Has to Be Notified

Notification obligations reach well beyond affected individuals. Healthcare entities report to HHS. Financial institutions report to the FTC. Telecom carriers report to the FCC, FBI, and Secret Service. Public companies file with the SEC.

Many state statutes require notice to the state attorney general when a breach affects a threshold number of residents, often 500 or 1,000. That gives state officials the opening to monitor the response and decide whether to open their own investigation. Major media outlets come into play at higher thresholds: under HIPAA, media notification is required when more than 500 residents of a single state are affected.⁴ Consumer reporting agencies must also be alerted when a large-scale breach involves financial information or Social Security numbers, so the credit bureaus can prepare for a surge in fraud alert and freeze requests.

What the Notice Has to Say

The HIPAA rule provides one of the most detailed templates for notice content, and many state laws follow a similar pattern. A notice must include a description of what happened (with dates if known), the types of information involved, what the individual should do to protect themselves, what the organization is doing to investigate and prevent future incidents, and contact information including a toll-free phone number. The notice must be written in plain language.³

The FCC’s rules for telecom carriers require similar content: the estimated date of the breach, a description of the customer data affected, information about credit monitoring or freezes being offered, and steps customers can take to limit their risk based on the specific type of data exposed.⁸ Most state laws also require contact information for the major credit bureaus so consumers can place fraud alerts or credit freezes.

Penalties for Failing to Notify

HIPAA civil penalties are tiered by culpability, running from a few hundred dollars per violation for unknowing failures up to roughly $2 million per year for willful neglect that goes uncorrected. Criminal penalties apply when someone knowingly obtains or discloses protected health information in violation of HIPAA: fines up to $50,000 and one year of imprisonment for basic violations, up to $100,000 and five years when false pretenses are involved, and up to $250,000 and ten years when the conduct is driven by commercial gain or intent to cause harm.¹

The FTC’s Health Breach Notification Rule carries civil penalties up to $53,088 per violation for entities handling health data outside HIPAA.⁹ State civil penalties for notification failures typically run from around $100 to $50,000 per violation, with some states imposing per-day fines that accumulate during extended delays. A handful of states classify intentional failure to notify as a misdemeanor. The FTC’s broader Section 5 authority has produced settlements reaching the hundreds of millions of dollars for companies whose security failures caused large-scale consumer harm.²

Private Lawsuits After a Breach

Regulatory penalties are not the only exposure. Companies that suffer breaches frequently face class actions from affected consumers, though the biggest hurdle for plaintiffs is proving standing in federal court. Under the Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez, a plaintiff must show a “concrete” injury with a close relationship to harms traditionally recognized in American courts, such as financial loss or reputational damage.¹⁴ The fact that data was exposed does not automatically satisfy that requirement.

The Court was explicit that “the mere risk of future harm, without more, cannot qualify as a concrete harm in a suit for damages.”¹⁴ That leaves many breach plaintiffs waiting until identity theft actually occurs before they can demonstrate the kind of injury federal courts require. Some state courts apply more permissive standing rules, and a small number of states have enacted statutes creating a private right of action with statutory damages, letting consumers recover a set amount per incident regardless of whether they can prove actual loss. Those statutory damages provisions have become a serious litigation risk after large breaches.

Preparing Before an Incident

The worst time to work out your notification obligations is during an active breach. A written incident response plan should identify the notification laws applicable to your industry and the states where your customers live, designate the internal team responsible for breach response (typically IT security, legal, communications, and senior management), and establish relationships with outside forensic investigators and legal counsel before anything happens.¹⁵

During an incident, secure affected systems without destroying forensic evidence, identify the scope of the compromised data, and determine which deadlines apply. Document every decision and its timing. Regulators reviewing the response after the fact focus heavily on whether you acted within the required windows and whether you can demonstrate the basis for each decision. The companies that get into the most trouble are often not the ones with the worst security, but the ones that delayed notice without justification or failed to document their reasoning.

1
Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
2
Federal Trade Commission. Privacy and Security Enforcement
3
eCFR. 45 CFR 164.404 – Notification to Individuals
4
eCFR. 45 CFR Part 164 Subpart D – Notification in the Case of Breach of Unsecured Protected Health Information
5
Federal Trade Commission. Gramm-Leach-Bliley Act
6
eCFR. 16 CFR 314.4 – Elements
7
Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
8
Federal Register. Data Breach Reporting Requirements
9
Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule
10
U.S. Securities and Exchange Commission. Form 8-K
11
U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
12
eCFR. 17 CFR 229.106 (Item 106) – Cybersecurity
13
U.S. Department of Health and Human Services. Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals
14
Supreme Court of the United States. TransUnion LLC v. Ramirez
15
Federal Trade Commission. Data Breach Response – A Guide for Business