• Data breach notification laws are state laws that define certain reporting requirements after a data breach regarding (1) applicability (i.e. what types of entities are subject to the law and any applicable “threshold” of the affected state of residents that determines whether notice is required or not), (2) notice requirements for parties to be notified that a breach has occurred, (3) notice time requirements, and (4) specific penalties that may be incurred for non-compliance . As of this writing, 48 of the 50 states have their own slightly different data breach notification laws.