What are the breach notification deadlines and penalties under state privacy laws?

Breach notification deadlines and penalties are not set by a single national rule. In the United States, every state has enacted its own data breach notification statute, so the specific timelines and consequences depend on which residents are affected, not on where your organization is located. Because these laws vary, this answer describes the common patterns rather than precise figures, which can change as legislatures amend their statutes.

How deadlines are typically structured

Most state laws require notice to affected individuals “without unreasonable delay” after a breach involving covered personal information is discovered. Many states layer a firm outer limit on top of that standard, often expressed in a fixed number of days from discovery or from completion of the investigation. A common approach:

• A general “without unreasonable delay” obligation as the baseline.
• An outer deadline (frequently in the range of weeks to a couple of months) for notifying individuals.
• Separate, sometimes shorter, deadlines for notifying the state attorney general or consumer agencies when the breach exceeds a resident threshold.
• A requirement to notify nationwide credit reporting agencies for larger breaches.

Sector-specific rules (such as those for health or financial data) may impose their own, sometimes stricter, timelines that operate alongside state law.

Typical penalties and exposure

Consequences also vary by jurisdiction but commonly include:

• Civil penalties assessed per violation or per affected individual, often enforced by the state attorney general.
• Injunctive relief and required remediation.
• In some states, a private right of action allowing affected individuals to sue.
• Reputational harm and downstream regulatory scrutiny.

What records and IG professionals should do

Because deadlines start running at discovery, strong records and information governance practices reduce both risk and response time:

• Maintain an accurate data inventory so you know what personal information you hold and where.
• Apply defensible retention and disposition to limit the volume of sensitive data exposed in any incident.
• Document an incident-response and notification process mapped to the states where your data subjects reside.
• Preserve breach-related records to demonstrate timely, good-faith compliance.

Frameworks like the NIST Privacy Framework help operationalize these controls. For related guidance, see the privacy and PII topic hub. Always confirm current deadlines and penalty amounts against the applicable state statute or qualified counsel, since the details differ and change over time.