Four basic tenets of U.S. State Data Breach Laws

California’s landmark SB1386 was the first data breach law enacted. A data breach law covers the requirements companies have to notify consumers whose personal information has been compromised (such as a copy being stolen or lost, and presumably in the hands of someone not entitled to have that information). A significant majority of U.S. states have followed suit, although each has its own requirements. The four basic tenets are as follows:

1. Notification guidelines: when a company is required to inform people whose data privacy has been breached

2. Penalty for failure to disclose: whether

3. Private right of action: if/when individuals have the right to file a lawsuit

4. Exemptions: what kind of breaches are exempt from reporting, such as those for encrypted data