As 2019 gets underway, I thought it would be a good time to review data breach notification laws and the impact they can have on a company suffering a data security incident. 2018 saw a number of new laws come into being, with others updated and modified. For example, Alabama closed things out by being the fiftieth state to pass a breach notification law. It's law is among the most comprehensive, imposing a number of obligations on companies conducting business in the state. South Dakota enacted its data breach notification law as well in 2018. Other states, such as Ohio, provided safe harbor for companies satisfying certain cybersecurity obligations. A number of states, such as Colorado, Arizona, Oregon, and Louisiana restricted the time periods for notification.
Below is a list of data breach notification charts and interactive maps provided by large law firms and other entities. Legal members of an incident response team may want to keep one or all of these at the ready for quick reference.
Baker Hostetler data breach charts. July 2018
Foley Lardner data breach chart. September 2018
Perkins Foie data breach interactive map. June 2018
Davis Wright Tramaine data breach interactive map (by harm, data form, authority notice). Dec 2018
NCSL list of security breach laws. Sept 2018
Mintz Levin data breach notification laws. June 2018