Data breach notification: what agencies must do after an incident

Reference article · 7 min read

When an agency learns that data may have been exposed, two questions arrive at the same time: what happened, and who has to be told. The second question is a legal one with a clock attached. Every state has a data breach notification statute, and most reach public entities as well as private companies, sometimes through separate provisions written specifically for government agencies. The statute that applies is generally the one covering the state where each affected person resides, not the state where the agency sits, so an incident touching a regional or statewide dataset can involve several statutes at once.

What follows describes how these laws are generally structured, so that a program manager or IT director can orient quickly in the first hours and think clearly when drafting policy later. Definitions, thresholds, deadlines, and exemptions differ from state to state and are amended often. The official text of the statute and the agency's counsel, frequently working with the state attorney general's office, govern what the agency must actually do.

What counts as personal information

Most statutes define personal information as a person's name combined with one or more sensitive data elements. The traditional combinations are the name plus a Social Security number, a driver's license or state identification number, or a financial account number together with a code that would permit access to the account. Many states have expanded the definition over time to include medical information, health insurance identifiers, biometric data, taxpayer identification numbers, passport numbers, and, in some states, a username or email address together with a password or security question answer.

Two limits appear almost everywhere. Information lawfully made available to the public from government records is usually excluded. Data that was encrypted, redacted, or otherwise rendered unusable is often excluded as well, though that safe harbor typically disappears if the encryption key was also taken. Because the safe harbor turns on the state of the data at the moment of the incident, encryption at rest and disciplined key management are worth far more than their cost.

What triggers the duty to notify

The usual trigger is unauthorized acquisition of, or in some states unauthorized access to, unencrypted personal information that compromises its security, confidentiality, or integrity. Several points shape whether a given event qualifies:

Acquisition versus access. Some statutes require evidence that data was taken; others treat unauthorized access alone as sufficient. This distinction decides many close cases.
Risk of harm analysis. Many states permit an agency to conclude, usually after a documented assessment, that misuse is not reasonably likely and notice is not required. Some require that the determination be documented and retained, and some require it be reported to the attorney general even when no notice goes out.
Good faith exception. Acquisition by an employee or agent for agency purposes, without further misuse, is commonly excluded.
Discovery through a vendor. When a service provider holds data on the agency's behalf, the vendor generally must notify the agency, and the agency, as the owner of the data, carries the duty to notify individuals.

What a notice usually has to contain

Statutes commonly prescribe some or all of the following: a description of the incident in general terms, the types of personal information involved, the approximate date or date range, what the agency is doing in response, what individuals can do to protect themselves, contact information for the agency, and the toll free numbers and addresses of the major consumer reporting agencies and the Federal Trade Commission. Some states require an offer of credit monitoring or identity theft services when Social Security numbers or certain other elements are involved, and some prescribe a minimum duration for that offer.

Notice is normally delivered in writing or by email where the individual has agreed to electronic communication. Substitute notice, typically a combination of email, a conspicuous website posting, and notice to statewide media, is allowed when the affected group or the cost of direct notice exceeds statutory thresholds or when contact information is not available.

Who else gets notified

Individual notice is often only part of the obligation:

The state attorney general or another designated office, in many states, when the number of affected residents exceeds a threshold, and in some states for every incident. Several states publish submitted notices.
Consumer reporting agencies, when the number of affected individuals exceeds a statutory threshold.
Sector regulators and federal programs. A covered entity handling protected health information has obligations under the HIPAA breach notification rule. Agencies holding federal tax information have reporting duties under IRS Publication 1075. Criminal justice systems carry incident reporting duties through the state CJIS systems agency. Grant and data sharing agreements often add their own.
State IT or homeland security offices. Some states require public entities to report incidents to a state chief information security officer, fusion center, or emergency management agency on a much shorter timeline than the notice to individuals.

Most statutes also allow notice to be delayed when a law enforcement agency determines that it would impede an investigation, usually requiring the request be documented and notice issued promptly afterward.

Timing, and why the vendor clock matters

Deadlines take two shapes. Nearly all statutes require notice without unreasonable delay, allowing time to determine the scope of the incident and restore reasonable integrity to the system. Many add an outer limit measured in days from discovery. An agency cannot meet an outer limit it learns about late, which is why the vendor's notice obligation is the practical hinge in most incidents involving a hosted system.

Contract language should therefore give the agency a margin rather than match the statutory deadline:

Notice to a named agency contact within a short, defined period after the vendor discovers or reasonably suspects an incident, stated in hours
A definition of reportable security incident that is broader than the statutory definition of breach, so the agency hears about events it may need to assess
An obligation to preserve logs and forensic images, and to provide the agency and its investigators access to them
Agency control over the content, timing, and method of any notice to individuals, the media, or regulators, with no unilateral vendor notice
Vendor responsibility for the costs of investigation, notification, call center support, and any required credit monitoring when the incident arose on the vendor's side
Flow down of the same duties to subcontractors and hosting providers
Cyber liability insurance, and breach related liability carved out of the general limitation of liability
Log retention long enough to scope an incident that is discovered months later

How to prepare before the call comes

Know where personal information lives. A current data inventory, including which vendors hold what, determines how fast the agency can scope an incident.
Keep counsel involved from the first hour. Determination of whether an incident is a reportable breach is a legal call, and privilege considerations start early.
Pre draft templates. Notice letters, a website posting, a press statement, and a call script, reviewed by counsel in advance, remove days from the timeline.
Maintain a notification contact list. Attorney general submission portals, state reporting contacts, insurers, and vendor escalation paths, verified annually.
Exercise it. Include the notification decision, not only technical containment, in tabletop exercises, and invite major vendors to participate.
Plan for records requests. Incident records and notices may be subject to public records law, often with a security exemption that must be asserted correctly.

HQT works with agency security and IT teams on incident response readiness, log and evidence retention design, and the technical requirements that make breach obligations workable. Legal determinations under a specific statute remain with the agency's counsel.

Frequently asked questions

How quickly does a state agency have to notify people after a data breach?

Almost every state statute requires notice without unreasonable delay after the agency determines a reportable breach occurred, allowing reasonable time to investigate scope and restore system integrity. Many states add an outer deadline counted in days from discovery, and the number of days differs by state. Some states also require much faster reporting to a state chief information security officer or attorney general. Confirm the current deadline in the applicable statute with counsel, since these provisions are amended frequently.

Do breach notification laws apply to cities, counties, and school districts, or only to businesses?

Most state breach notification statutes apply to public entities, either by including government agencies in the definition of covered entity or through a parallel provision written for them. A minority of states treat public entities differently on points such as substitute notice or attorney general reporting. Separate obligations may also apply through HIPAA, IRS Publication 1075, CJIS, or grant agreements. The agency's counsel should confirm which provisions cover it.

Which state's law applies when the breach affects residents of several states?

Breach notification duties generally follow the residence of the affected individuals rather than the location of the agency or the server. If an agency's records include residents of other states, the notification laws of those states can apply to those individuals. Agencies with multistate datasets usually assemble a state by state analysis with counsel before sending any notices, since content requirements and deadlines vary.

Does encrypted data still have to be reported as a breach?

Many statutes exclude data that was encrypted, redacted, or otherwise rendered unusable at the time of the incident, which is why encryption at rest is valuable beyond the security benefit itself. The exclusion typically does not apply if the encryption key or the means to decrypt was also compromised. Some states condition the exclusion on a specific encryption standard. Document the encryption state of the affected data early, because that fact often decides whether notice is required.

What should a contract require a vendor to do after a security incident?

Require notice to a named agency contact within a defined number of hours after the vendor discovers or reasonably suspects an incident, using a definition of reportable incident broader than the statutory definition of breach. Require preservation of logs and forensic images, cooperation with the agency's investigators, and agency control over the content and timing of any notice. Assign the costs of investigation, notification, and any required credit monitoring to the vendor when the incident arose on its side, and flow the same duties down to subcontractors.