---
title: "Decide whether a data breach has to be notified, and to whom the state rule points"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-11-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Decide whether a data breach has to be notified, and to whom the state rule points

> List the kind of personal information involved, whether it was unencrypted, the states where the affected people live, and whether health information or account numbers are in the set.…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List the kind of personal information involved, whether it was unencrypted, the states where the affected people live, and whether health information or account numbers are in the set. Do not pick a single national deadline. |
| What the lawyer must review | The FTC's Data Breach Response guide says all states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information, and that other laws may apply depending on the type of information. It does not state one federal consumer deadline. The California Attorney General's page states that California law requires a business to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person, citing California Civil Code section 1798.82(a). A business that must notify more than 500 California residents as a result of a single breach must electronically submit one sample copy of the notice, excluding personally identifiable information, to the Attorney General. |
| Written for | United States |
| Applies to | [Decide whether a suspected data breach is notifiable](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-a-suspected-data-breach-is-notifiable.md) |

## Checking plan

- What the AI does: List the kind of personal information involved, whether it was unencrypted, the states where the affected people live, and whether health information or account numbers are in the set. Do not pick a single national deadline.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- If the information is electronic personal health records, the FTC guide says to check the Health Breach Notification Rule and, separately, the HIPAA Breach Notification Rule. Those are not the general state consumer-notice statutes.
- Do not import an Australian 30-day assessment period. Read the statute of each state where a resident lives.

## Sources

- [Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) (checked 2026-10-22)
- [California Attorney General: Data Security Breach Reporting](https://oag.ca.gov/privacy/databreach/reporting) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*