Governance, risk & compliance

US state data breach notification: common elements and state differences State statutes and AG pages read 24 Oct 2026

Breach notification laws are generally reported to exist in all 50 states and the District of Columbia (this pack read the laws of about 35 of them), and they differ.

This framework lists the elements that nearly every law has as domains (what is covered, what counts as a breach, timing, content, regulator and credit bureau notice, service providers, law enforcement delay, remedies, enforcement) and gives a template for a notice that works across states. The STATES domain is a differences table limited to states where a fixed deadline or a regulator-notice trigger was read from the statute or an official page on 24 October 2026; the rest are hedged, not guessed.

Fixed deadlines read: 30 days in CO, FL, ME and WA; 45 days in AZ, MD, OH, OR, RI and VT; 60 days in CT, DE and SD. Most other laws read say only that notice must be made without unreasonable delay.

Regulator notice triggers read vary: any number of residents (MA, MT, NC, and NH to the AG or primary regulator), 50 or more (DC), over 250 (ND, OR, SD), 500 or more (CO, DE, FL, IA, OK, RI, WA, UT, CA), and over 1,000 (AR, AZ, HI, MO, SC, VA). Timing differs too: before individuals (MD), no later than individual notice (CT, DE, NE), at the same time (MT), the earlier of the same time or 45 days after the harm determination (AR), within 5 business days after notice (IA), 10 days after (LA) or 60 days after (OK).

Some states add remedies such as 24 months of identity theft services (CT), one year of credit monitoring (DE) or five years of identity theft protection (RI, SSN condition not confirmed). Laws change often: Vermont has a later version effective 1 January 2027, Oklahoma’s regulator notice took effect 1 January 2026, and California is reported (UNVERIFIED, the legislature site could not be read) to have added a 30-day deadline from 1 January 2026.

NOT read and not asserted: AL, AK, GA, IL, IN, KY, MS, NJ, NM, TN, TX and WI. New York is in NY_SHIELD and Pennsylvania in PA_BPINA.

Always have counsel confirm the current text of each affected state before sending notices. A section applies the duties to incidents involving AI tools (an AI service is a vendor holding personal information).

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses US state data breach notification: common elements and state differences at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to US state data breach notification: common elements and state differences compliance

Most of US state data breach notification: common elements and state differences comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to US state data breach notification: common elements and state differences, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against US state data breach notification: common elements and state differences in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports US state data breach notification: common elements and state differences as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.