US Breach Response Checklist

A structured checklist for US-regulated organisations covering state notification laws, SEC filing requirements, HIPAA, and FTC obligations. Work through it on screen during an incident, or print it empty for your incident response binder.

Last updated: April 2026 Jurisdiction: United States (federal + state) See also: EU/GDPR Checklist

Organisation

Incident Detected

Incident Reference

General Counsel / Privacy Lead

0 of 34 tasks completed 0%

Phase 2 Hour 4–24: Scope & Assessment

Determine data categories affected — SSNs, financial account data, biometric data, login credentials, health information? Different states define “personal information” differently.

Map affected individuals by state of residence — notification obligations depend on what data was exposed and where the affected people live.

Estimate number of affected individuals — some states have different thresholds (e.g., California AG notification when 500+ residents affected).

Assess ongoing vs contained — is the breach still active? Is exfiltration continuing?

Invalidate sessions globally — revoke all session tokens and OAuth grants for affected accounts. Password resets alone are insufficient.

Check sector-specific obligations — HIPAA (healthcare, 60-day notification to HHS), GLBA (financial services), FERPA (education). These run in parallel with state laws.

Assess FTC Act exposure — FTC has brought enforcement actions under Section 5 for inadequate breach response, even absent a specific breach notification law.

Evaluate encryption status — some states provide safe harbours for encrypted data. Document whether affected data was encrypted at rest and in transit.

Draft internal “what we know” memo — brief board and staff before media learns. Prevents rumours and aligns messaging.

Phase 3 Hour 24–48: Notification Preparation

Draft individual notification letters — most states require: description of incident, types of information involved, steps taken, company contact, and credit reporting agency contacts.

Prepare State Attorney General notifications — at least 35 states require AG notification. Compile list of required filings by state.

Determine credit monitoring obligation — several states mandate free credit monitoring (typically 12–24 months) when SSNs or financial data are involved.

Prepare SEC Form 8-K (public companies) — 4-business-day clock from materiality determination, not from breach date.

Prepare HIPAA notification (if applicable) — HHS notification within 60 days for breaches affecting 500+ individuals. Breaches under 500: annual log submission.

Identify third-party data recipients — Rhode Island and Delaware require proactive disclosure of specific third parties that received breached data.

Prepare holding statement — 100-word public statement: acknowledge event, express concern, designate single contact point. Legal reviews before release.

Phase 4 Execute Notifications (per state timeline)

File state notifications per timeline — most aggressive: Florida, Colorado, Washington (30 days). Others: “without unreasonable delay” (generally interpreted as 30–60 days).

Send individual notification letters — most states accept first-class mail. Some permit email if individual previously consented to electronic communication.

File federal notifications — SEC 8-K (public companies), HHS (HIPAA entities), other sector-specific regulators as applicable.

Activate credit monitoring for affected individuals — if required by applicable state laws. Distribute enrolment instructions with notification letters.

Issue holding statement if media aware — coordinate with legal. Public statements must not contradict regulatory filings.

Document all notification actions — record exact submission dates, confirmation numbers, delivery methods, and state-by-state filing status.

Phase 5 Post-Notification: Remediation & Review

Prepare for State AG follow-up — California, New York, and Massachusetts AGs actively investigate after notification. Expect questions about pre-breach security posture.

Update notifications as scope evolves — the FTC and state regulators expect organisations to provide updated information as new details emerge.

Incident Notes

Key Legal References

FTC Data Breach Response Guide — ftc.gov/business-guidance
SEC Form 8-K, Item 1.05 — Material cybersecurity incident disclosure (4 business days from materiality determination)
HIPAA Breach Notification Rule — 45 CFR 164.400–414 (60 days for breaches affecting 500+ individuals)
State breach notification laws — All 50 states + DC, Guam, Puerto Rico, and US Virgin Islands have enacted statutes
NIST Cybersecurity Framework — Incident response guidance (Respond and Recover functions)
Article source — Corporate Breach Response Checklist: The First 72 Hours

US breach notification — FAQ

Is there a single federal data breach notification law in the US?

No. The US has no single federal breach-notification statute for general personal data. All 50 states, plus DC and several territories, have their own breach-notification laws, layered with sector-specific federal rules such as HIPAA for health data and GLBA for financial institutions. Your obligations are driven by where the affected individuals reside, not where your organisation is based.

How quickly must I notify after a US data breach?

It varies by state. Many require notification without unreasonable delay, while others set hard deadlines, commonly 30, 45, or 60 days from discovery. Some states also require notifying the state Attorney General, often above a threshold such as 500 or 1,000 affected residents. Because a breach can span several states, the strictest applicable deadline usually governs your timeline.

Who do I have to notify after a breach?

Typically the affected individuals, and depending on the state and scale: the state Attorney General or regulator, the major credit reporting agencies, and, under sector rules, bodies such as HHS for HIPAA-covered health data. A multi-state breach commonly requires notifying several Attorneys General at once, each on that state's own timeline and format.

When is breach notification legally required in the US?

Generally when unencrypted personal information is reasonably believed to have been acquired by an unauthorised party. Each state defines the triggering data, but it usually means a name combined with a Social Security number, driver's licence number, or financial account details. Most states exempt breaches of properly encrypted data where the key was not also compromised, but the risk assessment must be documented.

What about HIPAA, SEC, and other federal rules?

Federal and sector rules run in parallel with state law. HIPAA requires covered entities to notify individuals, HHS, and, for breaches affecting 500 or more, the media, generally within 60 days. Public companies must file an SEC Form 8-K, Item 1.05, within four business days of determining a cybersecurity incident is material. GLBA covers financial institutions. When a breach touches regulated data, you must satisfy both state law and every applicable federal framework, whichever is stricter on each point.

This checklist is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for your specific situation. Your checklist data is stored locally in your browser and is never transmitted to our servers.

← EU/GDPR Breach Response Checklist

US Breach Response Checklist

First 4 Hours: Containment and Triage

Hours 4–24: Scope and Assessment

Hours 24–48: State and Federal Notification Preparation

Execute Notifications

Post-Notification: Remediation and Review

Key Legal References

Key Legal References

US breach notification — FAQ