Keep the US breach notice laws as data

How to do it

Every US state has a breach notice law, and the state of residence of each affected person decides which ones apply. Many say "without unreasonable delay", and some set a limit in days. Examples are 30 days in Colorado, Florida and Washington. Some also require a notice to the attorney general above a number of residents, such as more than 500 in California. Count affected people per state from your data, then feed the deadlines into the reporting clocks. A listed company may also owe the SEC a Form 8-K within four business days after it decides an incident is material.

Example

const DAY_MS = 86_400_000;
const STATE_BREACH_LAWS = {
  CO: { days: 30, regulatorFrom: 500 },
  FL: { days: 30, regulatorFrom: 500 },
  WA: { days: 30, regulatorFrom: 501 },
  CA: { days: null, regulatorFrom: 501 },
};

export const stateBreachSteps = (discoveredAt, residentsByState) => Object.entries(residentsByState).flatMap(([state, count]) => {
  const law = STATE_BREACH_LAWS[state];
  if (!law) return [{ state, step: 'look up this state before you send anything' }];
  const due = law.days ? new Date(discoveredAt.getTime() + law.days * DAY_MS) : 'without unreasonable delay';
  return [{ state, step: 'notify people', due }, ...(count >= law.regulatorFrom ? [{ state, step: 'notify the attorney general', due }] : [])];
});

from datetime import datetime, timedelta

STATE_BREACH_LAWS = {
    "CO": {"days": 30, "regulator_from": 500},
    "FL": {"days": 30, "regulator_from": 500},
    "WA": {"days": 30, "regulator_from": 501},
    "CA": {"days": None, "regulator_from": 501},
}

def state_breach_steps(discovered_at: datetime, residents_by_state: dict[str, int]) -> list[dict]:
    steps = []
    for state, count in residents_by_state.items():
        law = STATE_BREACH_LAWS.get(state)
        if law is None:
            steps.append({"state": state, "step": "look up this state before you send anything"})
            continue
        due = discovered_at + timedelta(days=law["days"]) if law["days"] else "without unreasonable delay"
        steps.append({"state": state, "step": "notify people", "due": due})
        if count >= law["regulator_from"]:
            steps.append({"state": state, "step": "notify the attorney general", "due": due})
    return steps

How to check

A unit test feeds a breach with people in Colorado and California into the tool. It shows the 30-day Colorado deadline, and it adds the California attorney general step once California residents pass 500.