What Businesses Must Do After a Data Breach

Discovering a data breach starts a clock — nearly every state has its own breach notification law, and the specific obligations depend on what data was exposed and who was affected.

Immediate Response Steps

The first priority is containing the breach — stopping ongoing unauthorized access — followed by a forensic investigation to determine what data was actually accessed or exfiltrated and how many individuals were affected.

Engaging legal counsel early in this process is important, since the investigation itself can be protected by attorney-client privilege when properly structured, and counsel can help coordinate the notification obligations that follow.

State Notification Requirements

All 50 states have their own breach notification laws, generally requiring notice to affected individuals "without unreasonable delay," though many set specific outer deadlines and additional requirements for notifying state attorneys general or credit bureaus for larger breaches.

Because these laws differ in their definitions of what counts as a breach and what data triggers notification, a breach affecting individuals across multiple states can require navigating several different sets of requirements simultaneously.

Beyond Legal Notification

Many businesses also offer credit monitoring or identity theft protection services to affected individuals, both as a goodwill gesture and, in some states, as an increasingly expected practice.

A clear, honest communication strategy — explaining what happened, what data was involved, and what steps are being taken — helps preserve customer trust even when the breach itself couldn't be fully prevented.

Frequently Asked Questions

How quickly must I notify affected individuals after a breach?

Timelines vary by state, but most require notification without unreasonable delay, and several set specific maximum timeframes, some as short as 30 days.

Do I need to notify anyone if the breached data was encrypted?

Many state laws provide a safe harbor for encrypted data, but this depends on the specific law and whether the encryption key was also compromised.

Data breach response involves urgent, overlapping legal obligations across potentially many states. A data privacy attorney can help you respond quickly and correctly when a breach occurs.