US data breach notification laws — every state in one place

The 4 things every multi-state breach team gets wrong

1. Sequencing — Maryland and New Jersey require AG/State-Police notice BEFORE residents. Louisiana requires AG within 10 days AFTER residents. Most other states require simultaneous filing.
2. Harm threshold — California, Illinois, Tennessee and Minnesota are largely no-harm-threshold states (notify on acquisition). Other states allow a documented "no reasonable risk" exception — but the documentation must be retained 3-5 years.
3. PI definition — Each state defines "personal information" differently. Washington and Wyoming include date of birth; Wisconsin includes DNA; Illinois has separate BIPA exposure for biometrics; New York's SHIELD Act covers unauthorized ACCESS (not just acquisition).
4. Vendor flowdowns — If you are the processor, most states (e.g. Alabama) require you to notify the controller within 10 days — NOT the residents directly. Misrouting notification is itself a violation.

One breach. 51 jurisdictions. A 72-hour clock.

Run a free audit of your privacy policy and incident-response language against every state breach notification statute and we'll surface every gap before you have to use it for real.