State-by-State Data Breach Reporting 2025

If you have been the victim of a data breach, you may be eligible for financial compensation for the damages that you have suffered. An experienced national data breach attorney at Federman & Sherwood can represent you in seeking to hold someone else accountable for failing to protect your sensitive information.

Data breach reporting is governed by the laws of the individual states. The laws of each jurisdiction may vary, but it is up to any entity doing business in that state to know their requirements. If they fail to provide you with the required notification under the terms of the law, not only could it strengthen your case, but it could mean that you receive more money in a lawsuit.

You can make a business answer legally for their carelessness in protecting your personal data, and the national data breach lawyers at Federman & Sherwood can help you do it. Speak to a data breach attorney today in a free initial consultation, where you will learn about your legal rights.

The Importance of Promptly Reporting Data Breaches

Since there is no single underlying Federal data breach law, reporting is a matter of state statute. Each state may have its own law governing when and how a data breach must be reported. Those who possess your sensitive personal information must follow the law in each state when there has been a data breach. The failure to properly report data breaches in accordance with state law can be a factor that can make things worse for a defendant in an individual or class action lawsuit. Delays in reporting can leave you exposed for a longer amount of time, leading to even higher damages.

The Laws About Data Breach Reporting in Individual States

All 50 states and the District of Columbia have laws that govern the reporting of data breaches. Many states have been tightening these laws in recent years, either shortening the amount of time that an entity has to report a data breach to the state or imposing additional requirements on that entity. Some states have stricter laws than others, although jurisdictions that have less strict laws have passed amendments in recent years to make them tougher.

General features of data breach reporting laws may include the following:

• How long the entity has to report
• Which entities must report the data breach
• Who must be reported to (e.g., the state and the person whose information was compromised
• The content of the notice
• The method that the entity must use to report a data breach
• The type of personal information that triggers data reach reporting requirements

Data Breach Laws in Individual States

Here are some examples of data breach reporting laws in certain states:

• Texas: Notification must be made to affected individuals without unreasonable delay, and no later than 60 days after the breach. If there are more than 250 Texas residents affected, the entity must notify the State’s Attorney General within 30 days.
• California: Entities must notify affected consumers within 30 days after the data breach and make a report to the state within 15 days after informing victims. California law gives data breach victims a private right of action to sue the entity if they did not make prompt notice.
• Oklahoma: Data breaches must be reported to affected individuals without reasonable delay. If the breach affects more than 500 Oklahoma residents, The entity must make a report to the State’s Attorney General within 60 days after notifying the individuals.
• New York: Entities have 30 days from the time of the breach to notify affected consumers. They must also notify state agencies. If more than 5,000 New York residents were effective, the entity must also notify a consumer reporting agency.

Even if a state does not allow a private right of action against the covered entity because they fail to notify you of a data breach, it may become a factor in your civil lawsuit. First, your damages could magnify because you were not able to take action to protect yourself in time to keep them from becoming worse. Second, failure to comply with data breach notification laws could also be evidence of recklessness. If you take your case to trial and when, you could even potentially obtain punitive damages for this failure if it was willful. Regardless, other evidence of improper conduct by the entity that was supposed to protect your information can be helpful in winning your lawsuit.

Contact a National Data Breach Law Firm

If you have been the victim of a data breach, speak to an attorney at Federman & Sherwood about the possibility of filing or joining a lawsuit. We are available to speak to you during a free initial consultation, which you can schedule by visiting our website or by calling us today at (800) 237-1277. Attorneys’ fees may even be covered as part of a class action settlement.