The State Clocks and Where They Differ

The state notification statutes divide into two families that behave very differently under pressure. One family names a number of days and treats it as an outer limit. The other names no number and requires notice in the most expedient time possible and without unreasonable delay. Both kinds are in force at once across any sizeable population of affected residents, and the interaction between them, rather than either one alone, is what governs the schedule.

The statutes that name a number

The short end of the range has converged on thirty days. California requires disclosure within thirty calendar days of discovery or notification of the breach. Washington requires notification to affected consumers in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered. New York requires notice without unreasonable delay and within thirty days after the breach has been discovered. Maine sets thirty days from the point at which the entity becomes aware of a breach and has identified its scope.

Above that band sit the forty-five day statutes. Ohio requires disclosure in the most expedient time possible but not later than forty-five days following discovery or notification. Vermont sets the same forty-five days to consumers, counted from discovery or notification. Delaware sits at the long end, requiring notice not later than sixty days after determination of the breach.

The counting event, which is not always discovery

Two statutes can share a number and still run on different schedules, because they start from different events. Washington, New York and California count from discovery. Florida counts thirty days from the determination of the breach or from the point at which there is reason to believe a breach occurred, which is a later moment in almost every incident. Delaware likewise counts from determination.

The gap between discovery and determination is the whole of the investigation, and it is often the largest single block of time in an incident. A statute counting from determination is therefore more generous in fact than its number suggests, and one counting from discovery is less generous. Nothing in the discovery-based statutes suspends the count while the determination is being made; the investigation has to fit inside the period, not precede it.

The statutes that name no number

A substantial group of states requires disclosure in the most expedient time possible and without unreasonable delay, and stops there. The formula descends from the earliest state statute and has survived amendment in many places even where a number was added elsewhere in the same section. Its practical effect is not leniency. A fixed-day statute at least tells an organization when it is safe; an open-ended one never does, because reasonableness is assessed afterwards against the facts as they developed.

The open-ended statutes also interact with the numbered ones in a way that is easy to miss. Every numbered statute in this field keeps the expedient-time language alongside the number. Thirty days is a ceiling, not an entitlement. An organization that identified the affected population in four days and notified on the twenty-ninth has satisfied the number and can still be said to have delayed unreasonably. The number does not displace the standard; it caps it.

Reading an open-ended statute therefore means reading it against practice rather than against a calendar. The reference points available are the numbers other legislatures have chosen and the allowances the same statute grants for scope determination and law enforcement. An organization that finishes its analysis quickly and then holds the letters for reasons unrelated to accuracy has no defense in an open-ended state that it would not also lack in a thirty-day one. What the absence of a number removes is the certainty on the other side: there is no day on which delay becomes safe.

Working to the shortest applicable clock

Because each statute governs the residents of its own state, an incident spanning many states creates many simultaneous obligations rather than one. In operational terms the shortest applicable clock sets the schedule for the whole notification round. Staggering by jurisdiction is possible, but it multiplies the number of drafts in circulation and creates the risk that two versions of the same account reach the public. That sequencing problem is treated in full in handling an incident that crosses many states.

One qualification is worth stating plainly. Running to the shortest clock is an operational choice rather than a rule of law, and it costs something. A statute allowing sixty days from determination was drafted to let an entity identify its population accurately, and notifying on day twenty-eight to match a neighboring state can mean writing to people whose records turn out not to have been involved. Over-notification has consequences of its own, including a corrective second letter that weakens the first. The choice is between a defensible schedule and an accurate list, and most organizations take the schedule.

Working to the shortest clock also has a definitional consequence. The threshold question of whether the facts amount to a breach must be answered on that compressed schedule, which is why the analysis described in the definitions that decide whether a breach occurred is done in parallel with the forensic work rather than after it.

The delays the statutes actually permit

Three allowances recur. The first is law enforcement: notice may be delayed where an agency determines that notification would impede a criminal investigation, and the clock resumes on the agency's say-so rather than the organization's. The mechanics of that request are set out in delaying notice at the request of law enforcement. The second is scope and integrity: several statutes allow the time reasonably necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. The third is narrower and appears in Florida, which permits fifteen additional days if written good cause is provided to the regulator inside the original thirty.

None of these is self-executing. Each depends on a record made at the time: the identity of the officer who asked for the delay, the reason the scope could not yet be determined, the good-cause letter that was actually sent. Where the record is thin, the allowance is difficult to invoke later, and the organization is left defending a plain reading of the number. Regulator filings and their own thresholds are treated separately in the counts that trigger a filing with a state regulator.