Breach-notification law
In one sentence
State and federal laws requiring you to notify people (and sometimes regulators) when their personal data is exposed.
All 50 US states have breach-notification laws with deadlines that start when a breach is discovered. Depending on your data and location, you may have to notify affected individuals, state attorneys general, or regulators within a set window.
Why it's on your cyber insurance application
Why your IR plan must know who to call fast: notification clocks start at discovery.
What this looks like in practice
Deadlines are counted in days, from discovery, and the rules that apply depend on where the affected people live rather than where you are. A business with customers in several states can be inside several laws at once. You don't need to memorize them. You need a plan that gets a lawyer who does on the phone in the first day.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, those documents are:
Where this comes up by trade
Some trades get asked about this harder than others, usually because a rule or a claim pattern already points at it. These pages have that detail.
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.