Notification: Timing to Affected Parties
Last reviewed:
The most common timing standard is as expeditiously as possible and without unreasonable delay. Where a specific cap is set, 45 days after discovery is the most common, but the industry best practice is 30 days, so 45 days could be deemed unreasonable in some states without justification.
The standard phrase, as expeditiously as possible and without unreasonable delay, allows time for a reasonable investigation and to restore the integrity of the data system. Where states attach a hard cap, 45 days after discovery is the most common.
For national operations, industry best practice is 30 days. A delay to 45 days could be considered unreasonable in some states absent a valid explanation - so do not treat 45 days as a safe universal target.
Key terms - quick answers
What is “As expeditiously as possible and without unreasonable delay”?
Keep going - free
Every study note on this site is free. So are these: