Data Breach Notification Rights

What a business must tell you when your personal information is exposed, which laws require it, what the notice must say, and what a person whose data was breached can actually claim.

Looking for a lawyer rather than a definition? Skip to the state-by-state list of law firms for this.

What it means

There is no general federal data breach law. Notification is required by the statutes of every state, which apply according to the residence of the people whose information was exposed, and by federal rules for particular sectors: health information under the HIPAA breach notification rule, financial institutions under the Gramm-Leach-Bliley safeguards rule and the banking regulators, and public companies under securities disclosure rules. A single breach therefore often triggers several overlapping obligations with different definitions, deadlines and recipients.

The state statutes share a shape. They apply to unauthorized acquisition of defined personal information - typically a name combined with a Social Security number, driver's license number, financial account number with access code, and increasingly medical, biometric and login credentials; they require notice to affected residents within a period after discovery, in a form that describes what happened, what information was involved, what the business is doing and what the person can do; and many require notice to the state attorney general and to the credit bureaus once the number affected passes a threshold. Encrypted data is usually exempt if the key was not also taken. Some states also require the business to offer credit monitoring or identity protection services for a period.

What a person can recover is less settled than what they must be told. Notification statutes mostly give enforcement to the attorney general; a private claim, where it exists, usually runs through negligence, breach of contract, the state consumer protection statute, or a specific privacy statute such as California's, which allows statutory damages for a breach caused by a failure to maintain reasonable security. Courts continue to divide on whether the risk of future misuse, without actual fraud, is an injury a plaintiff can sue on, and the Supreme Court has held that exposure without concrete harm does not by itself confer standing in federal court.

Where this comes from

When people hire a lawyer for this

A person who receives a breach notice should act on it - freeze their credit, change the affected credentials, and keep the letter - rather than wait to see whether fraud follows, because the letter is the evidence of when they knew. Whether to sue is a question for a lawyer who handles these cases, and the honest answer is usually that individual claims are small and class actions are slow; a business that has discovered a breach needs counsel immediately, since the notification deadlines run from discovery and the analysis of which states' and which sectors' rules apply is itself the first legal task.

Worried about the cost? A lawyer can be hired for one part of a case only (limited-scope representation), may be paid from what a claim recovers (contingency fee), or may be free through a pro bono program or legal aid; a court can also waive its own filing fees.

Find a lawyer for this in your state

Choose your state to see Identity Theft law firms in the city where we list the most; your city may be under “other cities”, A to Z. A state marked “Consumer Rights” has no Identity Theft listing yet and opens the broader page.

• Alabama (Birmingham)
  +1 other city

  • Montgomery
• Alaska (Anchorage, Consumer Rights)
• Arizona (Chandler)
  +6 other cities

  • Gilbert
  • Glendale
  • Mesa
  • Phoenix
  • Scottsdale
  • Tucson
• Arkansas (Little Rock)
• California (Anaheim)
  +19 other cities

  • Bakersfield
  • Chula Vista
  • Fontana
  • Fremont
  • Irvine
  • Long Beach
  • Los Angeles
  • Oxnard
  • Riverside
  • San Bernardino
  • San Diego
  • Santa Ana
  • and 7 more with fewer listed firms
• Colorado (Aurora)
  +2 other cities

  • Colorado Springs
  • Denver
• Connecticut (Bridgeport)
• Delaware (Wilmington, Consumer Rights)
• District of Columbia (Washington)
• Florida (Hialeah)
  +5 other cities

  • Jacksonville
  • Miami
  • Orlando
  • St Petersburg
  • Tampa
• Georgia (Atlanta)
• Hawaii (Honolulu, Consumer Rights)
• Idaho (Boise, Consumer Rights)
• Illinois (Chicago)
• Indiana (Fort Wayne)
  +1 other city

  • Indianapolis
• Iowa (Des Moines)
• Kansas (Wichita, Consumer Rights)
• Kentucky (Lexington)
  +1 other city

  • Louisville
• Louisiana (Baton Rouge)
  +1 other city

  • New Orleans
• Maine (Portland, Consumer Rights)
• Maryland (Baltimore)
• Massachusetts (Boston, Consumer Rights)
• Michigan (Detroit)
• Minnesota (Minneapolis)
  +1 other city

  • Saint Paul
• Mississippi (Jackson, Consumer Rights)
• Missouri (Kansas City)
  +1 other city

  • St. Louis
• Montana (Billings, Consumer Rights)
• Nebraska (Lincoln)
  +1 other city

  • Omaha
• Nevada (Henderson)
  +2 other cities

  • Las Vegas
  • North Las Vegas
• New Hampshire (Manchester)
• New Jersey (Jersey City)
  +1 other city

  • Newark
• New Mexico (Albuquerque)
• New York (Buffalo)
  +2 other cities

  • New York City
  • Rochester
• North Carolina (Charlotte, Consumer Rights)
  +5 other cities

  • Durham
  • Fayetteville
  • Greensboro
  • Raleigh
  • Winston-Salem
• North Dakota (Fargo, Consumer Rights)
• Ohio (Cincinnati)
  +3 other cities

  • Cleveland
  • Columbus
  • Toledo
• Oklahoma (Oklahoma City)
  +1 other city

  • Tulsa
• Oregon (Portland)
• Pennsylvania (Philadelphia)
  +1 other city

  • Pittsburgh
• Rhode Island (Providence, Consumer Rights)
• South Carolina (Columbia)
• South Dakota (Sioux Falls, Consumer Rights)
• Tennessee (Nashville)
• Texas (Arlington)
  +9 other cities

  • Austin
  • Corpus Christi
  • Dallas
  • Fort Worth
  • Garland
  • Houston
  • Irving
  • Plano
  • San Antonio
• Utah (Salt Lake City, Consumer Rights)
• Vermont (Burlington)
• Virginia (Richmond)
  +3 other cities

  • Chesapeake
  • Norfolk
  • Virginia Beach
• Washington (Seattle)
  +2 other cities

  • Spokane
  • Tacoma
• West Virginia (Charleston)
• Wisconsin (Madison)
• Wyoming (Cheyenne, Consumer Rights)

Related terms

Other entries in the same area of law, each written from the same primary sources.

• Automatic Renewal and Negative Option SubscriptionsThe federal and state rules on subscriptions that keep charging until you cancel - what a seller must disclose and obtain before enrolling you, the cancellation mechanism it must offer, and where the law currently stands.
• Billing Error Dispute (Credit Card Chargeback)The federal procedure for disputing a charge on a credit card statement - a written process with deadlines on both sides that the card issuer must follow, not a courtesy it may offer.
• Class ActionOne lawsuit brought by named plaintiffs on behalf of a larger group with the same injury.
• Cooling-Off Rule (Canceling a Door-to-Door Sale)The federal right to cancel certain sales made at your home or away from the seller's regular place of business, the notice the seller must give you, and the many sales it does not reach.
• Credit Freeze and Fraud AlertTwo free federal tools for stopping identity thieves from opening accounts in your name - one that locks your credit file, one that warns lenders to check who they are dealing with.
• Credit Report DisputeThe federal process for forcing a credit bureau and the company that reported an item to investigate information you say is wrong.
• Debt Validation Notice and Disputing a DebtThe written notice a debt collector must send when it first contacts you, what it must contain, and the dispute right it opens - during which the collector must stop until it verifies the debt.
• Fair Debt Collection (Collector Conduct Rules)Federal limits on what a third-party debt collector may say and do - including a written demand that stops contact, and a 30-day right to make them verify the debt.
• Gift Card and Prepaid Card RulesThe federal limits on gift card expiration and fees, the state laws that go further, and the separate protections for reloadable prepaid cards used like bank accounts.
• Identity Theft Recovery RightsThe federal rights a victim of identity theft can use to remove fraudulent accounts from a credit report, obtain the records of what the thief did, stop the debts being collected, and limit liability for the charges.
• Implied Warranty and the Magnuson-Moss ActThe promises the law reads into a sale whether or not anyone wrote them down, and the federal act that limits how a seller can take them away.
• Mandatory Arbitration ClauseA term in a consumer contract that sends any dispute to a private arbitrator instead of a court, usually alone rather than as part of a class - and federal law makes most of them enforceable.
• Right of Rescission (Home Loans)A federal right to cancel certain loans secured by your home during a short window after signing - and for much longer if the lender failed to give the required disclosures.
• Robocalls and the TCPAThe federal law that restricts automated and prerecorded calls and texts to your phone, gives you a Do Not Call right, and lets you sue for a fixed amount per illegal call.
• Time-Barred DebtA debt so old that the statute of limitations bars a lawsuit to collect it - what a collector may and may not do about it, how a payment can revive it, and why the credit-reporting clock is a different clock.
• Unauthorized Debit Card and Electronic Transfers (Regulation E)The federal rules that limit a consumer's loss from an unauthorized debit card, ATM, ACH or payment-app transfer, require the bank to investigate an error, and decide who bears a loss the consumer was tricked into sending themselves.
• Unfair and Deceptive Practices (UDAP)The consumer-protection laws, one federal and one in every state, that make it illegal for a business to mislead you or treat you unfairly - and the state versions are the ones a consumer can actually sue under.
• Vehicle RepossessionA lender's right to take back a financed car after default without going to court - subject to rules about how it is taken, how it is sold, and what you can still be made to pay afterwards.
• Wage GarnishmentA legal order requiring an employer to withhold part of someone's pay and send it to a creditor.

« All glossary terms