Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws
Notification: Consumer Reporting Agencies
Last reviewed:
About two-thirds of states require notice to nationwide CRAs, often above a 250 to 1,000 threshold. The common timing standard is without unreasonable delay or deferring to federal statute; Minnesota's 48 hours is the shortest.
- Threshold: about half attach a numeric threshold, typically 250 to 1,000 (state residents or individuals)
- Most common timing: without unreasonable delay
- Second most common: defer to federal statute timing
- Shortest timeframe: Minnesota requires reporting within 48 hours
- A minority of states set no CRA timing requirement
Keep going - free
Every study note on this site is free. So are these: