How to handle a customer data breach

Written by NotALawyer Legal AI · Reviewed by External Legal AI · Published April 27, 2026 · Last reviewed June 26, 2026

If your business holds customer data and gets breached, the first 72 hours shape what you owe later. Every state has its own notification law, and many set hard deadlines that don't pause for your investigation. Here's the practical playbook.

1. Hour 1: Contain the breach and preserve the evidence

Disconnect affected systems from the network, but don't wipe them. The forensic evidence on them is critical. Pull in IT security and, if you have it, your cyber-insurance breach response team. Log every step with timestamps.

2. Day 1: Bring in breach counsel

A lawyer experienced in breach response can run the investigation under attorney-client privilege, pin down which laws apply, and start the notification clock on solid footing. This step tends to pay for itself.

3. Pin down exactly what data was accessed

Notification triggers turn on data type: names plus Social Security numbers, financial account numbers, health info, biometrics. The more sensitive the data, the broader and faster the required notifications.

4. Notify under each affected state's law

All 50 states have breach notification statutes, and each sets its own deadline by statute. Most require notice "in the most expedient time possible" — typically 30 to 60 days — and some impose a hard cutoff that doesn't pause for your investigation. Check the law in every state where affected customers live.

5. Offer credit monitoring and document your remediation

Most state laws and customer expectations point to 12 to 24 months of free credit monitoring. Document everything you did to investigate, notify, and remediate — that record is your shield in any later regulatory or civil action.

Start a Chat Find a Business Attorney

More on this topic: the Small Business hub

Sources & primary references

Data breach notification deadline by stateCompare the breach-notice deadline in all 50 states.

This is the longest a company can wait to tell you after it discovers that your personal information was exposed in a data breach. Each value is cited to the state statute or agency; a state with no sourced figure shows "Not yet sourced."

State	Breach-notice deadline	Source
Alabama	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Alaska	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Arizona	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Arkansas	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
California	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Colorado	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Connecticut	60 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Delaware	60 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
District of Columbia	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Florida	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Georgia	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Hawaii	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Idaho	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Illinois	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Indiana	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Iowa	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Kansas	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Kentucky	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Louisiana	60 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Maine	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Maryland	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Massachusetts	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Michigan	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Minnesota	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Mississippi	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Missouri	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Montana	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Nebraska	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Nevada	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
New Hampshire	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
New Jersey	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
New Mexico	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
New York	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
North Carolina	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
North Dakota	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Ohio	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Oklahoma	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Oregon	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Pennsylvania	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Rhode Island	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
South Carolina	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
South Dakota	60 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Tennessee	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Texas	60 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Utah	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Vermont	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Virginia	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Washington	30 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
West Virginia	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Wisconsin	45 days	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)
Wyoming	Without unreasonable delay	Foley & Lardner, State Data Breach Notification Laws (Oct. 2025)

General information, not legal advice. Rules change and exceptions apply — confirm the current rule with the cited source for your state.

NotALawyer.com provides general legal information, not legal advice.