Guide ยท State law
What is a data breach notification law?
State statutes
All 50 states and DC have breach notification statutes, summarised on our laws index. Each defines personal information, what counts as a breach, who must notify, when, and whether the attorney general must be told.
Is there a federal data breach notification law?
There is no single general federal breach notification law covering all businesses. Federal rules apply by sector, for example the HIPAA Breach Notification Rule for health information. The FTC publishes a data breach response guide for business.
Who enforces state breach notification laws?
Usually the state attorney general. Some statutes also give individuals a private right of action; see each state page. Find your AG through NAAG.
Why did I get a data breach notification?
Because an organisation holding your information believes it was exposed in a way the law requires it to report. See what to do after a data breach notice.
Frequently asked questions
What is a data breach notification?
A notice from an organisation telling you that your personal information was or may have been accessed or acquired without authorisation, usually required by state law.
Are companies required to report data breaches?
Generally yes under state breach notification laws, which set who must notify, what is covered and when. Health organisations also have HIPAA duties.
Who enforces state data breach notification laws?
Usually the state attorney general. Some state laws also allow individuals to sue.
Why did I get a data breach notification?
An organisation that holds your information believes it was exposed in a way the law requires it to report to you.
Sources
Last updated 2026-10-20.