Keep the US breach notice laws as data

Region

United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Every US state has a breach notice law, and the state of residence of each affected person decides which ones apply. Many say "without unreasonable delay", and some set a limit in days. Examples are 30 days in California, Colorado, Florida and Washington. Some also require a notice to the attorney general above a number of residents. California asks for it above 500 residents, within 15 days of telling the people. Count affected people per state from your data, then feed the deadlines into the reporting clocks. A listed company may also owe the SEC a Form 8-K within four business days after it decides an incident is material. Add them to the plan for a data breach.

Examples

JavaScript example

const DAY_MS = 86_400_000;
const STATE_BREACH_LAWS = {
  CO: { days: 30, regulatorFrom: 500 },
  FL: { days: 30, regulatorFrom: 500 },
  WA: { days: 30, regulatorFrom: 501 },
  CA: { days: 30, regulatorFrom: 501, regulatorDaysAfterNotice: 15 },
};
const addDays = (date, days) => new Date(date.getTime() + days * DAY_MS);

export const stateBreachSteps = (discoveredAt, residentsByState) => Object.entries(residentsByState).flatMap(([state, count]) => {
  const law = STATE_BREACH_LAWS[state];
  if (!law) return [{ state, step: 'look up this state before you send anything' }];
  const due = addDays(discoveredAt, law.days);
  const regulatorDue = addDays(due, law.regulatorDaysAfterNotice ?? 0);
  return [{ state, step: 'notify people', due }, ...(count >= law.regulatorFrom ? [{ state, step: 'notify the attorney general', due: regulatorDue }] : [])];
});

Python example

from datetime import datetime, timedelta

STATE_BREACH_LAWS = {
    "CO": {"days": 30, "regulator_from": 500},
    "FL": {"days": 30, "regulator_from": 500},
    "WA": {"days": 30, "regulator_from": 501},
    "CA": {"days": 30, "regulator_from": 501, "regulator_days_after_notice": 15},
}

def state_breach_steps(discovered_at: datetime, residents_by_state: dict[str, int]) -> list[dict]:
    steps = []
    for state, count in residents_by_state.items():
        law = STATE_BREACH_LAWS.get(state)
        if law is None:
            steps.append({"state": state, "step": "look up this state before you send anything"})
            continue
        due = discovered_at + timedelta(days=law["days"])
        steps.append({"state": state, "step": "notify people", "due": due})
        if count >= law["regulator_from"]:
            regulator_due = due + timedelta(days=law.get("regulator_days_after_notice", 0))
            steps.append({"state": state, "step": "notify the attorney general", "due": regulator_due})
    return steps

How to check

A unit test feeds a breach with people in Colorado and California into the tool. It shows the 30-day Colorado deadline. It adds the California attorney general step, due 15 days after the notice to people, once California residents pass 500.

Sources

• California Attorney General on data breach reporting
• California Civil Code section 1798.82

Related rules

• CMP-21 Start every reporting clock from one moment in Compliance and governance
• CMP-71 Plan for a data breach in Compliance and governance
• CMP-77 Report health data leaks under the FTC rule when HIPAA does not cover you in Compliance and governance