Data Breach Notification Laws: What US Small Businesses Actually Owe Customers

If a breach happens, "do we have to tell anyone?" is not a question you want to be researching for the first time in the middle of the incident. Every US state has a breach-notification law, and they do not agree on the details. Most small businesses have never opened the ones that apply to them.

The common thread

Broadly, state laws require a business to notify affected people when certain categories of personal information are exposed. A typical definition is a person's name combined with a Social Security number, a driver's license number, or an account or card number with the access code needed to use it. Some states add medical or health insurance information and other categories. Many laws also require notice to a state attorney general or another regulator in some circumstances.

Nevada, where CM Tech Software is based, is a useful example. NRS Chapter 603A requires businesses holding Nevada residents' personal information to maintain reasonable security measures and to give notice of breaches. Its definition generally centers on a name plus an SSN, driver's license, account or card number with access code, a medical or health insurance ID number, or a username or email address with the password to an online account. Encrypted data and last-four-digit samples are generally outside that definition. Other states draw the lines differently.

What varies from state to state

• What triggers the duty. Which data types count, and whether encryption or the likelihood of harm changes the answer.
• Who must be told. Affected individuals, a state regulator, sometimes consumer reporting agencies. Tax and accounting firms covered by the FTC Safeguards Rule may also have to notify the FTC; ask your attorney.
• Timing. Deadlines vary by state, and some laws use general language such as "without unreasonable delay" while others set a number of days. Check the current law for each state where your clients live rather than relying on a rule of thumb.
• What the notice must say. Content requirements differ.

Why "we will figure it out if it happens" is risky

Three problems tend to appear together. First, the clock generally starts when you discover the problem, not when you finish investigating it. Second, the duty usually depends on exactly which data types were exposed, which you cannot answer quickly without an inventory. Third, multi-state exposure is common: a single client list can include residents of many states, each with its own law.

Picture a small insurance agency whose office manager's laptop is stolen. The agency serves clients in three neighboring states. Before anyone can decide who must be told, they need to know whether the laptop held Social Security numbers, driver's license numbers or policy files, how many distinct people, and whether the disk was encrypted. An office that can answer in an hour is in a very different position from one that needs weeks.

Preparation that actually helps

1. Know your data. Maintain a current picture of which sensitive data types sit on which computers.
2. Know your states. List the states where your clients live and bookmark each state's current notification statute or attorney general guidance.
3. Encrypt portable devices. Many laws treat properly encrypted data differently, though the details vary.
4. Name your contacts. Decide in advance who calls your attorney, your insurer and your IT provider.
5. Keep a log. Record the date and time of discovery and each action afterward.

How a scan fits

MyVaultMate does not decide whether you must notify, and it cannot tell you what a thief actually viewed. Its recurring scans help you document what sensitive data sits where: findings record the file path, kind of data, severity, frameworks involved and a count of distinct values in each file, with short redacted samples only. That gives your attorney a faster starting point for the question "what could have been exposed?" Detection is rule-based, so occasional false alarms occur and not every file type is read.

This article is general education, not legal advice; please ask an attorney about your specific obligations. You can see what a report looks like at /sample.