Cyber insurance guide
Data breach notification laws by state
Breach notification statutes tell a business when and how to notify people whose personal information was compromised.
State statutes
| State | Data breach notification law |
|---|---|
| Washington | RCW 19.255 (personal information breach notification) |
| Oregon | ORS 646A.600 to 646A.628 (Oregon Consumer Information Protection Act) |
| Idaho | Idaho Code §§ 28-51-104 to 28-51-107 |
| Nevada | NRS chapter 603A (security and privacy of personal information) |
| Arkansas | Personal Information Protection Act, Ark. Code § 4-110-101 et seq. |
| Arizona | A.R.S. §§ 18-551 and 18-552 |
| South Dakota | SDCL §§ 22-40-19 to 22-40-26 |
| Pennsylvania | Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq. |
| Texas | Texas Business and Commerce Code § 521.053 |
| Indiana | Indiana Code article 24-4.9 (disclosure of security breach) |
Statute names are provided for reference only. Read the current text and talk with counsel about any specific incident.
What these laws generally cover
- A definition of personal information, often a name combined with a Social Security number, driver's license or state ID, or financial account number with access codes
- A definition of a breach, sometimes with a risk-of-harm analysis
- A deadline or a standard such as without unreasonable delay
- Content and method requirements for notices
- Notice to the state attorney general or consumer reporting agencies above certain thresholds
- Exceptions for encrypted data and for entities covered by federal rules
Why the law of residence matters
Notification duties follow the affected individuals, not your office. A Texas company with customers in Washington and Indiana must consider all three states' laws. A breach coach, typically a privacy attorney provided through your cyber policy, maps those duties for you.
Encryption helps
Most statutes exempt properly encrypted data when the key was not compromised. Encrypting laptops, phones, and databases is one of the simplest ways to reduce notification obligations.
This page is general information, not legal advice. Statutes change; read the current text.
Frequently asked questions
Does every state have a breach notification law?
Yes. All 50 states have breach notification laws, each with its own definitions and deadlines.
Which state's law applies?
Generally the law of the state where each affected individual lives, so a single breach can trigger several states' rules.
Does cyber insurance pay notification costs?
Breach response coverage typically pays for legal guidance, notification letters, call centers, and credit monitoring.
More coverage and guides
- First-party cyber coverage
- Third-party cyber liability
- Ransomware and cyber extortion coverage
- Social engineering and funds transfer fraud
- Cyber business interruption
- Regulatory defense and PCI coverage
- Data breach notification laws by state
- Security controls cyber insurers look for
- Cyber insurance application checklist
- What affects cyber insurance cost
- Building a cyber incident response plan
Last updated October 15, 2026 · How we research