Data breach notification laws by state are the statutes that tell any business which loses residents' personal information when and how to tell them, and whom else to tell. An insurer triggers the law of each state where an affected person lives, not the law of its home state, so one incident can trigger twenty statutes at once. They differ on every point that matters: what counts as personal information, whether mere access or only acquisition is a breach, how many days the letters may take and from what event, which attorney general or agency hears and at what count, when the credit bureaus are told, what the letter must and must not say, and whether a finding of no likely harm can excuse it. Texas allows 60 days from the determination and notifies its attorney general at 250 residents; Florida allows 30 and notifies its Department of Legal Affairs at 500. An insurer adds a second layer, because insurance data security laws send commissioners their own notices on a shorter clock.
Applying twenty statutes to tens of thousands of people is the core of data breach notification management, and the error that matters is rarely a misread statute; it is a person placed in the wrong state or a definition applied to the wrong data. Botminds' Data Breach Notification Management places every affected person by last known address and applies each state's law to the data elements exposed for that person, citing the clause; counsel owns the rules and decides any harm-based exception. Its fictional sample incident, a ransomware attack on Wrenfield Mutual's claims-mail vendor, touched 48,016 people in 20 states.
"said notice shall not include the nature of the breach of security or unauthorized acquisition or use, or the number of residents of the commonwealth affected by said breach of security or unauthorized access or use."
M.G.L. c. 93H §3(b), on the letter to Massachusetts residents
What are state data breach notification laws?
They are state statutes, usually in a consumer protection or business code, that require a business holding residents' personal information to notify them after a breach and to notify state officials and credit bureaus above set counts. Each has the same seven parts, written differently: a definition of personal information, a definition of breach, a deadline and the event it runs from, the recipients and their thresholds, the content of the letter, any exceptions, and enforcement.
The definitions decide most outcomes. Texas, Florida, California, New York and Washington all count medical information as personal information; New York also counts health insurance information, including "any information in an individual's application and claims history", which describes most of an insurer's files. New York's definition of breach also includes unauthorised access, not only acquisition, while Texas's turns on "unauthorized acquisition". The Texas, Florida, California and New York statutes apply to computerised or electronic data, which includes the scanned claims mail at the centre of the sample incident.
Residence decides: from one person to every notice
The decision tree starts from where each person lives and runs through the law of that state. Every branch below is a question the statute answers, and the answer for one state says nothing about the next. For an insurer, a separate branch asks whether the same state's insurance data security law sends a notice to its commissioner.
Which data breach notification laws one affected person triggers
- 1
Where does the person live?
The last known address decides the state. No usable address: search, then consider substitute notice. Never a guessed state.
- 2
Do the exposed elements count as personal information there?
Medical information counts in Texas, Florida, California, New York and Washington, but not in every state. If nothing counts, no letter, and the reason is recorded.
- 3
Is there an exception, and has counsel decided it?
Florida allows a written finding that harm is unlikely, and New York one for an inadvertent disclosure by authorised staff, each kept five years. Only counsel makes it.
- 4
A letter is owed: by when, from what event?
Texas 60 days from the determination; Florida 30 from the determination; New York, Washington and California 30 from discovery; Massachusetts as soon as practicable.
- 5
Does the state’s count pass a threshold?
Attorney general or agency: Texas 250, Florida 500, Washington and California over 500, New York and Massachusetts any. Credit bureaus: Florida over 1,000, New York over 5,000, Texas over 10,000.
- 6
For an insurer: does an insurance data security law apply?
In an adopting state, the commissioner if it is the home state or 250 or more consumers are involved; in New York, the superintendent within 72 hours; in Washington, the insurance commissioner within two business days.
Two branches catch insurers more than others. The first is step 1: a claim file's address can be years old, and a claimant who has moved is owed the letter of the state he lives in now. The second is step 6, which most published state charts leave out because most businesses never reach it. An insurer always does.
Texas data breach notification law
Texas requires a business to notify affected individuals within 60 days of determining a breach occurred and to notify its attorney general within 30 days when 250 or more Texans are affected. The individual notice must be made "without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred", with exceptions for law enforcement and for determining the scope of the breach. The attorney general must hear "not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state", through an online form that asks for six things, including the number of affected Texans and how many have already been sent a letter.
Texas defines sensitive personal information to include information that identifies a person and relates to their physical or mental health, their health care or payment for it, so claim files are squarely inside it. Above 10,000 people notified at one time, the nationwide credit bureaus are told the timing, distribution and content of the notices. Texas also lets a business notify a resident of another state under that state's law instead of its own, which matters for a Texas-based insurer with customers across the country. And it prices delay: up to $100 a person a day, capped at $250,000 a breach, on top of $2,000 to $50,000 a violation.
Florida data breach notification law
Florida requires notice to affected individuals within 30 days of determining a breach, notice to its Department of Legal Affairs within 30 days when 500 or more Floridians are affected, and notice to the credit bureaus above 1,000. The individual notice must be made "as expeditiously as practicable and without unreasonable delay", allowing time to determine the scope, identify the people and restore the system, but "no later than 30 days after the determination of a breach or reason to believe a breach occurred". A company can get 15 more days if it gives the Department good cause in writing within the 30.
Florida's definition counts medical history and condition, health insurance policy and subscriber numbers, biometric data and geolocation information. The Department's notice must include a synopsis, the number of Floridians affected, any free services offered, a copy of the letter and a contact; on request, the police or forensic report, the breach policies and the steps taken. Florida's harm exception requires consultation with law enforcement and a written finding sent to the Department within 30 days. A violation is treated as an unfair or deceptive trade practice, there is no private right of action, and civil penalties run by the day to a $500,000 maximum, per breach, as set out in what each late hour costs.
Texas and Florida compared
Texas and Florida answer the same questions with different numbers, and an insurer with customers in both runs both clocks from the same determination.
Texas and Florida breach laws, question by question
Texas, Bus. & Com. Code §521.053: 60 days after determining the breach occurred.
Florida, Stat. §501.171: 30 days after the determination of a breach or reason to believe one occurred; 15 more with good cause.
Texas, Bus. & Com. Code §521.053: Attorney general, 250 or more Texans, within 30 days, by online form.
Florida, Stat. §501.171: Department of Legal Affairs, 500 or more Floridians, within 30 days.
Texas, Bus. & Com. Code §521.053: More than 10,000 notified at one time.
Florida, Stat. §501.171: More than 1,000 at a single time.
Texas, Bus. & Com. Code §521.053: Counts: health, health care or payment for it.
Florida, Stat. §501.171: Counts: medical history, condition, treatment, and health insurance numbers.
Texas, Bus. & Com. Code §521.053: None in the section’s text.
Florida, Stat. §501.171: Yes, after consulting law enforcement, in writing, kept five years, sent to the Department.
Texas, Bus. & Com. Code §521.053: The vendor tells the data owner immediately.
Florida, Stat. §501.171: The vendor tells the company within 10 days.
Texas, Bus. & Com. Code §521.053: Up to $100 a person a day, capped at $250,000 a breach.
Florida, Stat. §501.171: $1,000 a day for 30 days, then $50,000 per 30 days, to $500,000 a breach.
Four more ways to write the same law: California, New York, Washington, Massachusetts
California, New York, Washington and Massachusetts show how far the same law can be bent. California, which gave no fixed number until 2026, and New York now give 30 days from discovery, and so does Washington. Massachusetts gives no number at all, and has the most to say about the letter.
Four more state breach laws an insurer often triggers
| State | Letters due | State officials | Credit bureaus | Letter content |
|---|---|---|---|---|
| California | 30 calendar days of discovery or notification (from 1 Jan 2026) | Attorney general: sample copy within 15 days of notifying, over 500 residents | Their numbers go in the letter when an SSN, driver’s licence or California ID number was exposed | “Notice of Data Breach”, set headings, 10-point type |
| New York | Within 30 days after the breach has been discovered | Attorney general, Department of State, State Police; DFS for its licensees; any number | More than 5,000 at one time | Contact details, agency phone numbers and websites, the elements involved |
| Washington | No more than 30 calendar days after discovery | Attorney general, more than 500 residents, within 30 days | Their numbers go in the letter | Plain language; the types of information; dates of the breach and of its discovery |
| Massachusetts | As soon as practicable and without unreasonable delay | Attorney general and Office of Consumer Affairs and Business Regulation, any number | Those the Office names | Police report, free security freeze, mitigation; never the nature of the breach or the number affected |
New York's letter clock reads plainly: notice "shall be made within thirty days after the breach has been discovered", except for law enforcement's needs. Washington's adds the conditions it allows: notice "in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered", unless law enforcement asks for a delay or the delay is needed to determine scope and restore the system. Both count from discovery, which for a vendor's breach can be the day the vendor's notice arrived, a day or more before an insurer's determination.
Massachusetts is the outlier on content. Its letter must tell residents of their right to a police report, how to request a security freeze, that the freeze is free, and what mitigation services are offered, and it must leave out the two things every other state's letter tends to lead with. A single national letter cannot be sent there.
The Massachusetts letter, with the reason each paragraph changed
Who enforces state data breach notification laws?
State attorneys general enforce them, usually as consumer protection violations, and for insurers the insurance regulator enforces the parallel insurance data security law. Texas's attorney general brings actions for civil penalties under the breach chapter and is owed the expenses of doing so. Florida's Department of Legal Affairs, the attorney general's department, treats a violation as an unfair or deceptive trade practice, and the statute creates no private right to sue. New York's attorney general may sue for damages to people who were not notified and, for knowing or reckless violations, civil penalties.
Attorneys general also see the volume. Washington's received notice of 209 breaches affecting more than 500 Washingtonians in the year to July 2025, affecting just over 8 million people, and found that ransomware was the most common method of cyberattack, at 65%; Social Security numbers were compromised in 173 of the breaches. The insurance side is enforced by commissioners under the model law's powers to examine and investigate, and in New York by the Department of Financial Services, whose cases are collected in New York's notification requirements, read from the fines.
Where insurers trip: definitions, claimants and the wrong address
Insurers trip on the same three things in most incidents. The first is the definition of personal information applied to health data. A medical-only claimant in a state that does not count medical information is not owed a letter there, and in the sample incident 2,206 claimants were in exactly that position under the sample rules; yet under the NAIC model the same people count toward a commissioner's 250, because the model's nonpublic information includes health information.
The second is that claimants are not customers. Injured third parties, workers' compensation claimants and beneficiaries appear in an insurer's files with addresses taken from claims, sometimes years old, and some of them are minors or deceased. The third is the start event. Texas and Florida count from the determination; New York, Washington and California count from discovery. An insurer that plans every letter from its own determination can be a day late in the discovery states whenever a vendor's notice came first.
One state, every notice owed in it
One state at a time, every state at once
Data Breach Notification Management applies each state's breach law to each person, not to a state total, and builds a page per state like the one above: who is owed a letter, by element, every notice owed in the state with its threshold and deadline, and what the letter must say there. Counsel keeps the rules; the agents apply them and cite them. A person the agents cannot place goes to claims operations, never to a guessed state, and a notice is marked "not owed" only when a count falls under a threshold, with the count shown.
For the matrix that holds those pages together, see the breach notification matrix template.
Questions people ask
Which state's breach law applies when an affected person has moved?
The law of the state where the person lives, which in practice means the most recent address the company holds. A claim file's address can be out of date, so the insurer's policy and claim systems should be checked for a newer one before a letter is addressed.
Does the Texas breach notification law require notice to the attorney general?
Yes, when the breach involves at least 250 Texans. The notice goes through the attorney general's online form no later than 30 days after the business determines the breach occurred, and the attorney general publishes a listing of the notifications it receives.
Does Florida's breach law count medical information?
Yes. Florida's definition of personal information includes medical history, mental or physical condition, medical treatment or diagnosis, and health insurance policy or subscriber numbers, each combined with a person's name.
Can an insurer send the same breach letter in every state?
No. California prescribes a title, headings and type size, and Massachusetts forbids describing the nature of the breach or the number of residents affected. A base letter with counsel-approved state versions is the usual answer.
Do state breach laws cover paper records?
The Texas, Florida, California and New York sections covered here apply to computerised or electronic data. Scanned documents held on a server, like the claims mail in the sample incident, are electronic data.