---
title: "Keep the US breach notice laws as data · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep the US breach notice laws as data

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- Rule: Keep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it.
- How: Every US state has a breach notice law, and the state of residence of each affected person decides which ones apply. Many say "without unreasonable delay", and some set a limit in days. Examples are 30 days in Colorado, Florida and Washington. Some also require a notice to the attorney general above a number of residents, such as more than 500 in California. Count affected people per state from your data, then feed the deadlines into the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks). A listed company may also owe the SEC a Form 8-K within four business days after it decides an incident is material.
- Check: A unit test feeds a breach with people in Colorado and California into the tool. It shows the 30-day Colorado deadline, and it adds the California attorney general step once California residents pass 500.

Example:

```js
const DAY_MS = 86_400_000;
const STATE_BREACH_LAWS = {
  CO: { days: 30, regulatorFrom: 500 },
  FL: { days: 30, regulatorFrom: 500 },
  WA: { days: 30, regulatorFrom: 501 },
  CA: { days: null, regulatorFrom: 501 },
};

export const stateBreachSteps = (discoveredAt, residentsByState) => Object.entries(residentsByState).flatMap(([state, count]) => {
  const law = STATE_BREACH_LAWS[state];
  if (!law) return [{ state, step: 'look up this state before you send anything' }];
  const due = law.days ? new Date(discoveredAt.getTime() + law.days * DAY_MS) : 'without unreasonable delay';
  return [{ state, step: 'notify people', due }, ...(count >= law.regulatorFrom ? [{ state, step: 'notify the attorney general', due }] : [])];
});
```

```python
from datetime import datetime, timedelta

STATE_BREACH_LAWS = {
    "CO": {"days": 30, "regulator_from": 500},
    "FL": {"days": 30, "regulator_from": 500},
    "WA": {"days": 30, "regulator_from": 501},
    "CA": {"days": None, "regulator_from": 501},
}

def state_breach_steps(discovered_at: datetime, residents_by_state: dict[str, int]) -> list[dict]:
    steps = []
    for state, count in residents_by_state.items():
        law = STATE_BREACH_LAWS.get(state)
        if law is None:
            steps.append({"state": state, "step": "look up this state before you send anything"})
            continue
        due = discovered_at + timedelta(days=law["days"]) if law["days"] else "without unreasonable delay"
        steps.append({"state": state, "step": "notify people", "due": due})
        if count >= law["regulator_from"]:
            steps.append({"state": state, "step": "notify the attorney general", "due": due})
    return steps
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws`.

- Previous: [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments)
- [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)