Handling an Incident That Crosses Many States
An incident touching residents of thirty states creates thirty obligations, not one. They share a factual account and almost nothing else: the clocks start on different events, the filing thresholds count different people, and the published notice is visible to every regulator at once.
The rule in short
A multi-state incident is managed by building one residency-mapped population, applying each statute's definition and exemptions to it, and then sequencing every deadline on a single calendar. The earliest obligation is often a preliminary regulator filing rather than a consumer letter. Because the notices and filings are read side by side, the controlling discipline is a single account of the facts that every document draws from without variation.
An incident affecting residents of many states is not one obligation applied broadly. It is a set of parallel obligations, each created by a different legislature, each counting a different population and each running on its own event. They share only the facts. Managing them well is mostly a matter of separating the parts that genuinely differ from the parts that only appear to.
Mapping the population before anything else
The first artifact is not a draft letter but a table of affected records sorted by the state of residence shown in the organization's own files. Every threshold in this field is expressed in residents of a particular state, so nothing can be counted until residency has been assigned. The table then has to survive two reductions. The first removes records covered by an encryption exemption, applied state by state because the definitions differ. The second removes records whose data categories fall outside a given state's definition of personal information.
What remains is not one number but a column of numbers, one per state, and those are the figures compared against filing thresholds. A national total of four hundred thousand tells nobody anything useful. The figure that matters in Washington is the count of Washington residents to be notified, and the figure that matters in Florida is the count of Florida individuals affected.
Building the table is usually the slowest part of the response and the part most often started late. Residency is scattered across billing records, account profiles, employment files and archived systems, and reconciling them is data work rather than legal work. Starting it on the day the incident is detected, in parallel with the forensic investigation and before anyone knows whether notice will be owed, is the single change that most reliably keeps a large response inside its deadlines. The table is also reusable: it feeds the consumer round, every filing threshold and the consumer reporting agency tier.
One calendar, several starting events
Deadlines then go on a single calendar, and the exercise reveals how little the numbers alone convey. Two states may both allow thirty days and expire weeks apart because one counts from discovery and the other from determination. A state allowing forty-five days to consumers may require a preliminary filing within fourteen business days of discovery, which will usually be the first external step of the whole response. And one state's regulator clock may not start until consumer notice has gone out, as California's does.
Ordering those events produces a workable sequence: the earliest preliminary filings, then the coordinated consumer round, then the filings keyed to that round, then the consumer reporting agency tier where the counts reach it. Each stage produces a document the next stage reuses, which is the practical reason the sequence is worth fixing before drafting begins rather than after. The underlying variation among the statutes is set out in the state clocks and where they differ.
| Stage | Typical earliest driver | What it produces | What it constrains |
|---|---|---|---|
| Preliminary regulator filing | Vermont, fourteen business days from discovery | A dated account of the incident on file with a state | Everything said later must be consistent with it |
| Consumer notice round | The shortest applicable consumer deadline | One letter carrying the union of required elements | Format follows the most prescriptive state |
| Filings keyed to the round | California, fifteen days after consumer notice | Sample copies and per-state resident counts | The sample is the letter that was actually sent |
| Consumer reporting agencies | Florida above one thousand, New York above five thousand | Notice of timing, content and distribution | Must not delay the consumer notice itself |
| Supplementary notice | New records identified after the round | A second letter that references the first | Runs on its own clock for the new population |
Why the account has to be identical everywhere
Every document produced in a multi-state incident is eventually read beside the others. Sample copies are filed with several regulators. Substitute notice, where it is used, is published where anyone can see it. Consumer reporting agencies receive a description of the notification program. The organization's own customers compare letters. There is no version of this process in which a difference between two accounts stays private.
The discipline that follows is a single written statement of what happened, what data was involved, when it was discovered and what has been done, from which every document draws. Where a state requires an element the others do not, that element is added rather than the account rewritten. Where the facts change, the statement is amended once and the amendment propagates. The alternative, letting each drafting team describe the incident in its own words, produces differences that are innocent in origin and impossible to explain afterwards.
Consistency is not the same as uniformity of detail. Some recipients get more than others because their statutes demand more, and a regulator filing properly contains material that would not appear in a household letter. What must not vary is anything a reader could treat as a contradiction: the date range of the incident, the categories of data involved, the number of people affected in a given state, and the description of what was done in response. Where one of those figures is genuinely uncertain, saying so once, in the same words everywhere, is safer than giving a firm figure that later has to move.
Working to the earliest deadline is an operational choice. It does not merge the obligations, and it does not mean a state's own requirements can be ignored because another state's were met. Each notice still has to satisfy the statute governing its recipients, each filing still has to be made with the body that statute names, and a delay obtained from a law enforcement agency in one jurisdiction does not answer the clock running in another, as explained in delaying notice at the request of law enforcement.
Where the volume itself creates problems
Three difficulties appear only at scale. The first is the substitute notice gateway: the cost of direct notice is assessed against the whole population to be notified, so a large multi-state incident can cross the cost threshold in every state at once and move the entire response into published notice, with the media requirements varying by state. Those conditions are set out in substitute notice when people cannot be reached.
The second is content collision. One state prescribes a title, five headings and a minimum type size; others require elements that must be fitted inside that structure. Building one letter to the union of requirements is usually possible, but it has to be done deliberately rather than by appending paragraphs, and the drafting constraints are set out in what the notice to an individual must say. The third is the residual population: records with no usable address, records whose residency cannot be determined, and records identified after the main round. Each of those groups needs its own decision, its own date and its own line in the file, because each of them will be the group a regulator asks about.
Points to carry away
- Each state governs its own residents, so one incident produces parallel obligations rather than a single deadline.
- The population is mapped by residency before any threshold is applied, because thresholds count residents of one state.
- The earliest external obligation can be a preliminary regulator filing due long before consumer notice.
- Counting events differ, so two thirty-day statutes can expire weeks apart.
- Published substitute notice is visible to every regulator, which removes the option of differing accounts.
- Supplementary notice as facts develop is better than delaying the first notice past a deadline.
Questions readers ask
Should the letters go out together or state by state?
Together, in almost every case. A staggered program means several drafts in circulation describing the same incident, and any difference between them becomes an issue once regulators compare notes. It also means the earliest recipients tell the later ones, and the organization loses control of how the incident is first described. The main argument for staggering is accuracy in a population that is still being resolved, and the usual answer to that is a single notice on the earliest deadline followed by supplementary notice as the picture firms up.
How is the affected population divided by state?
By the residency shown in the organization's own records, which is what the statutes key to when they speak of residents of the state. That produces edge cases: people who have moved, records with a billing address in one state and a service address in another, and records with no usable address at all. The conservative treatment is to include a record in every state to which it plausibly belongs for threshold purposes, since the cost of over-counting a threshold is a filing that was not strictly required.
What happens if the population grows after notice has gone out?
The newly identified people are notified on their own clocks, measured from the point at which the organization knew or should have known that their information was involved. Several statutes contemplate this by allowing notice in one or more mailings as information becomes available. The people already notified do not generally have to be written to again unless the new facts change what the earlier notice told them, in which case a supplementary notice is appropriate and should say plainly that it follows an earlier one.
Sources
- California Civil Code section 1798.82Thirty days from discovery to consumers and fifteen days from consumer notice for the regulator sample copy.
- 9 V.S.A. section 2435 — Vermont security breach noticeA fourteen business day preliminary regulator filing that falls due well before the forty-five day consumer deadline.
- Florida Statutes section 501.171Counts thirty days from determination rather than discovery and adds a consumer reporting agency tier above one thousand.
- RCW 19.255.010 — Washington notice of security breachesThirty days from discovery for both consumers and the attorney general, with a five hundred resident filing threshold.
- New York General Business Law section 899-aaRoutes notice to three state bodies and sets the consumer reporting agency tier above five thousand residents.
- Delaware Code title 6, chapter 12BSixty days from determination, with an express carve-out where a shorter time is required under federal law.
Rapid Response Law is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Breach Notification
The State Clocks and Where They Differ
State notification statutes fall into two families. One family sets an outer limit in days, counted either from discovery of the breach or from the determination that a breach occurred. The other family requires notice in the most expedient time possible and without unreasonable delay, with no number at all. Several states in the first family have moved to thirty days, others sit at forty-five or sixty, and the counting event differs even among statutes that share a number.
Notifying a Regulator and the Threshold That Triggers It
Most states require a filing with the attorney general once a set number of that state's residents must be notified. Five hundred is the most common figure, but the clock attached to it varies: some states measure from discovery, one measures from the date consumer notice goes out, and one requires a preliminary description long before consumers hear anything. Consumer reporting agencies form a third tier with higher counts and different content.
The Sixty-Day Rule for Health Information
A covered entity must notify each affected individual without unreasonable delay and in no case later than sixty calendar days after discovery of a breach of unsecured protected health information. Discovery is defined by knowledge attributed across the workforce, not by the moment senior management is briefed. Breaches touching five hundred or more individuals require contemporaneous notice to the Secretary and notice to prominent media; smaller ones are logged and reported annually.