Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws
Notification: Consumer Reporting Agencies
About two-thirds of states require notice to nationwide CRAs, often above a 250 to 1,000 threshold. The common timing standard is without unreasonable delay or deferring to federal statute; Minnesota's 48 hours is the shortest.
- Threshold: about half attach a numeric threshold, typically 250 to 1,000 (state residents or individuals)
- Most common timing: without unreasonable delay
- Second most common: defer to federal statute timing
- Shortest timeframe: Minnesota requires reporting within 48 hours
- A minority of states set no CRA timing requirement