Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws
When Notification May Be Delayed
When a breach is suspected to involve criminal activity, all states allow delay if law enforcement determines notice would impede a criminal investigation. Notice must issue as soon as the investigation concludes or law enforcement clears it.
All states allow a reasonable delay of required notifications if law enforcement determines notice would impede a criminal investigation. The covered entity must still notify as soon as possible once the investigation is complete or law enforcement decides notice will not compromise it.
Key terms - quick answers
What is “Law enforcement delay”?
A provision allowing breach notice to be postponed for a reasonable period when law enforcement determines that notification would impede a criminal investigation.