Insurance company data breach notification requirements: two clocks

An insurance company's data breach notification requirements run on two clocks at once. The first is insurance law: in the 28 jurisdictions that had adopted the NAIC Insurance Data Security Model Law by the NAIC's Summer 2026 count, the commissioner must hear within 72 hours, or a few business days where the state changed it, of a determination that a cybersecurity event occurred, and New York's superintendent within 72 hours of determining a cybersecurity incident. The second is breach law: each affected resident, and above set counts an attorney general and the credit bureaus, must be notified within 30 to 60 days under the statute of the state where the person lives. Most companies run only the second clock. An insurer runs both, and they start from different events: a determination, a discovery, or the day after a vendor's notice.

Keeping both clocks in one plan is the purpose of Botminds' Data Breach Notification Management. Its AI agents set every commissioner clock and every residents' clock from the facts counsel records, apply each state's insurance data security law and breach law, and draft every notice, while named people at the insurer decide and sign. This page follows its fictional sample incident, in which the vendor that scans Wrenfield Mutual's claims mail was hit by ransomware and told Wrenfield at 17:30 on Monday 21 September.

"The computation of Licensee’s deadlines shall begin on the day after the Third-Party Service Provider notifies the Licensee of the Cybersecurity Event or the Licensee otherwise has actual knowledge of the Cybersecurity Event, whichever is sooner."

NAIC Insurance Data Security Model Law §6.D(2), on an event at a vendor

What are an insurance company's data breach notification requirements?

An insurer must notify the insurance regulators that its state's insurance data security law names, within days, and every affected person, attorney general, agency and credit bureau that each resident's breach law names, within weeks. The insurance regulators are the home state's commissioner always, other adopting states' commissioners when 250 or more of their residents are involved and the event is reportable elsewhere or likely to cause material harm, New York's superintendent for its licensees, and in Washington the insurance commissioner under its own rule. The breach-law recipients depend on where the affected people live, as set out in who to notify after a data breach.

The two sets are not alternatives. Notifying the commissioner does not satisfy the breach law, and sending the letters does not satisfy the commissioner. They overlap in one place by design: the model law requires a copy of the consumer notice to go to the commissioner, so the second clock feeds back into the first.

Two laws, two clocks, drawn to scale

Drawn on one calendar, the clocks look like different kinds of obligation. The commissioner notices are due within the first week, before anyone knows exactly who was affected. The residents' letters are due weeks later, after the data review has placed everyone in a state. And each clock in each state starts from its own event.

The figure shows the trap. The commissioner clocks and the letter clocks are both "from the breach" in casual speech, yet in this one incident they start on three different days, and the earliest letter deadline runs from a different event than the earliest commissioner deadline. A plan that keeps one start date for everything is wrong somewhere, whichever date it picks.

Where the two clocks start: determination, discovery and the vendor's day after

Insurance data security laws mostly start from a determination; breach laws split between determination and discovery; and for a vendor's event the model starts the insurer's clock on the day after the vendor's notice, whatever the insurer has determined. Texas and Florida count residents' deadlines from the determination that a breach occurred. California counts from discovery or notification; New York and Washington from discovery. New York's insurance regulation counts from determining that an incident occurred, wherever it occurred, with no day-after rule.

The variations within the model states matter too. Delaware starts a vendor's clock on "the first business day after" the vendor's notice, not the next calendar day, and gives three business days rather than 72 hours. Washington's insurance commissioner hears within two business days of the insurer's determination that consumers must be notified, a trigger that sits inside the breach-law analysis rather than before it. Each is a start event a team has to write down on day one, as a date and time, with the source.

Insurance law and breach law compared

The two laws differ in what they protect, who they report to and what the report contains. Seeing them side by side explains why an insurer's privacy office and its regulatory counsel often run them as separate projects, and why that costs time.

The health row explains a pattern in the sample incident. The commissioner's count in a state included every person whose nonpublic information was in the files, medical-only claimants included, while the letters went only to people whose exposed elements counted under that state's breach law. In South Carolina that meant 9,812 people on the commissioner's update and 8,904 letters. Neither number was wrong.

How the two clocks connect: the letter copy and the count update

The clocks connect in two places, and both run from the breach-law side back to the commissioner. First, whenever a commissioner was owed a notice, the model requires the insurer to comply with the state's breach law and to "provide a copy of the notice sent to Consumers under that statute to the Commissioner". Second, the commissioner's notice carries a best estimate of the affected consumers in the state, which must be updated with each later report, and the data review that drives the letters is what changes it.

In the sample incident both links ran late in the incident. The eight commissioners were told 46,900 people on 23 and 24 September. The data review of 9 October found 48,016, so an update was owed to all eight. And each commissioner's copy of the letter went when that state's batch was mailed: on 14 October for most, with the later batches on 20 October and 2 November. A team that closes the commissioner file after the 72-hour notice will miss both.

The insurance notices are few but come first and are owed on the thinnest facts. The breach-law notices are many and come later, and they carry the counts the insurance notices have to be corrected to.

Who should own each clock inside an insurer

Each clock needs one named owner, and the links between them need owners too. In most insurers the commissioner clock sits with regulatory counsel, because the notice rests on counsel's determination and goes to the insurer's own regulators. The breach-law clocks sit with the privacy office, because they depend on the data review, the letters and the mailing. That split is sensible; the risk is in the two links, the count update and the letter copy, which belong to neither team's natural checklist.

The sample incident shows one way to divide it. Regulatory counsel recorded the determination, signed the eight commissioner notices and had their count update put in front of her for signature. The Chief Privacy Officer approved and released every letter batch. The letter copy for each commissioner was tied to the mailing of that state's batch, so it went out when the letters did rather than when someone remembered it, and the count update was drafted the moment the data review changed the totals. Both links had an owner because the plan showed them as notices in their own right.

Why the FTC's 30-day rule is not an insurer's

Many financial companies report breaches to the Federal Trade Commission under its Safeguards Rule, but insurers do not, because federal law hands their privacy oversight to the states. The Gramm-Leach-Bliley Act assigns enforcement "Under State insurance law, in the case of any person engaged in providing insurance, by the applicable State insurance authority of the State in which the person is domiciled". The FTC's rule, which requires a company under its jurisdiction to notify the Commission "no later than 30 days after discovery of the event" when at least 500 consumers' information is involved, does not reach them.

That allocation leaves the field to the states, and the NAIC model is how 28 jurisdictions have filled it, each in its own statute. It is also why an insurer's first regulator call after a breach is usually to an insurance department, not to Washington, and why the commissioner's clock, not a federal one, is usually the first to run out.

California Department of Insurance and data breach notification

California has not adopted the NAIC model, according to the NAIC's state page, which lists the state only under related activity: Department of Insurance regulations from 2002 and the state's consumer privacy statute. A California insurer's statutory duties after a breach therefore come mainly from the Civil Code: letters to residents within 30 calendar days of discovery or notification of the breach, a sample copy to the attorney general within 15 days of notifying more than 500 Californians, and the prescribed "Notice of Data Breach" format.

That does not settle the insurer's position in other states. A California-domiciled insurer with 250 or more affected residents in an adopting state owes that state's commissioner a notice under that state's law, and one licensed in New York owes the superintendent. Whether to inform the California Department of Insurance as well, absent a statutory duty, is a judgement for counsel; the Civil Code's clock runs either way.

The insurance company data breach notification letter

An insurer's letter differs from a retailer's in who receives it and what it describes. Many recipients are not customers: claimants, beneficiaries and injured third parties whose details sit in claim files. Some are minors, whose letters go to a parent or guardian, and some have died, whose letters go to the estate. In the sample incident 612 minors and 141 deceased claimants were handled separately for that reason.

The content follows the breach law of each recipient's state, not the insurance law, but the insurance law sees it: the commissioner receives the copy. A health insurer adds HIPAA, under which individual notice is due within 60 calendar days of discovery at the latest; California treats a HIPAA-compliant notice as meeting its content rules, and New York requires a HIPAA covered entity that notifies the Secretary of Health and Human Services to notify the state attorney general within five business days. That is a third clock, and for health insurers it runs beside the other two.

Both laws on one calendar: what happened and every deadline still ahead

Running both clocks in Data Breach Notification Management

The solution keeps the two laws as separate rules and one plan. Each state is a branch, and under it the commissioner notice, the attorney general or agency, the credit bureaus and the letters are leaves, each with its own clock and start event. The commissioner leaf stays open after the first notice until the count update and the letter copy are sent.

Insurance and breach notices in one plan, state by state

Counsel records the determination; the agents never set it. The vendor's notice date and time go in as facts with their source, and the start rule for each clock comes from counsel's rules, so a Delaware first-business-day start and a California discovery start sit in the same plan without anyone having to remember them. For the arithmetic of the shortest clocks, see the 72-hour breach notification requirements.

Questions people ask

Do insurance companies have to notify the state insurance department of a data breach?

In the 28 jurisdictions that adopted the NAIC model, yes: the home state's commissioner for any cybersecurity event determined to have occurred, and other adopting states' commissioners at 250 or more residents plus a further test. New York requires notice to the superintendent within 72 hours for its licensees, and Washington's insurance commissioner has its own two-business-day rule.

What are cybersecurity event notification requirements?

They are the insurance-law duties to notify a commissioner after a cybersecurity event, as distinct from the duty to notify residents of a breach. Under the model law the notice gives thirteen items, as much as possible, within 72 hours of the determination, and is updated as the facts change.

Does an insurer have to notify the FTC of a data breach?

Not under the FTC's Safeguards Rule. The Gramm-Leach-Bliley Act places insurers' privacy enforcement with the insurance authority of their home state, so the rule's 30-day notice to the Commission for breaches of 500 or more consumers applies to other financial companies.

When does the commissioner get a copy of the consumer letter?

When the letters are sent. The model law requires a licensee that owed the commissioner a notice to give the commissioner a copy of the notice sent to consumers under the state's breach law.

Does a reinsurer notify the affected consumers?

Not under the model law. A reinsurer without a direct relationship with the consumers notifies its affected ceding insurers and its home commissioner within 72 hours, and the ceding insurers send the consumer notices and any other notices the law requires.