U.S. state data breach notification laws

U.S. state data breach notification laws are separate state statutes, each requiring an organization whose personal data has been breached to warn the residents affected and, in many states, the attorney general, on its own deadline and terms. California went first. SB 1386 (Senate Bill 1386), codified at Civil Code section 1798.82, took effect on July 1, 2003 and requires notice to any resident whose unencrypted personal information was acquired without authorization. It took fifteen years for everyone else to follow. South Dakota signed its law on March 21, 2018; Alabama, with SB 318, closed the list a week later as the fiftieth state. The District of Columbia, Puerto Rico, Guam and the U.S. Virgin Islands have their own. No general federal statute preempts them: HIPAA (Health Insurance Portability and Accountability Act) and the disclosure rule of the SEC (Securities and Exchange Commission) each cover only their own perimeter. The result is a patchwork. Many states stick to “without unreasonable delay,” others set a hard cap: thirty days in Colorado, Florida, Washington, and California since SB 446 took effect on January 1, 2026; forty-five in Alabama, Ohio or Oregon; sixty in Texas. The attorney general (AG) threshold moves too. California wants a sample notice when more than 500 residents are notified, within fifteen days; Texas starts at 250; Colorado and Florida at 500. Definitions of personal information, encryption safe harbors and mandatory letter content differ too. For a cyber underwriter, multistate means billable hours. A file spread over forty states calls for a legal matrix, several letter templates and filings with dozens of AGs on different dates, and the shortest deadline drives the calendar of the whole campaign. That work lands in the breach coach line and in notification costs. Where claims get stuck: the AG filing often opens an inquiry, which then falls under regulatory investigation coverage and its own sublimit. Law enforcement delays exist, and they need a written request on file or the AG will not credit them.