Pre-launch draft — pending licensed attorney review.
These documents are working drafts based on research synthesis. Hardline has not yet recorded counsel sign-off or verified final entity status in this codebase. Do not rely on these documents for live paid lending activity until counsel review, entity verification, effective dates, and archived document hashes are complete.
50-State Breach-Notification Matrix
Per-jurisdiction reference covering all fifty U.S. states and the District of Columbia. Companion to the Incident Response Plan.
Version 1.0-draft · Last updated: 2026-05-10 · Effective: Pending counsel sign-off
This matrix is internal Hardline research, synthesized to support the notification analysis in Section 7 of the Incident Response Plan at /legal/incident-response § 7. It is not a substitute for state-specific legal review at the time of any actual incident. Statutes and regulator practice change frequently; every citation must be re-verified by counsel before reliance.
1.How to Read This Matrix
U.S. state breach-notification statutes are layered on top of, but not replaced by, the federal FTC Safeguards Rule (16 C.F.R. § 314.5). The federal layer requires notice to the FTC for the unauthorized acquisition of unencrypted customer information involving 500 or more consumers, within 30 days of discovery. The state layer requires notice to affected residents, and frequently to a state attorney general, banking department, or consumer-protection regulator, with substantial variation in trigger, deadline, content, and threshold.
Four conceptual fault lines structure the matrix:
- Acquisition versus access.Some statutes are triggered only when personal information is “acquired” without authorization; others are triggered the moment the information is “accessed.” The difference matters in practice: a database that an attacker could have read but apparently did not download may not trigger an “acquisition” statute but may trigger an “access” statute. New York’s SHIELD Act and New Jersey are leading “access” jurisdictions; many others are “acquisition.” Several layer a risk-of-harm filter on top, exempting incidents where there is no reasonable likelihood of misuse.
- Encryption safe harbor.Nearly every state exempts data that was encrypted, redacted, or rendered otherwise unusable — but the form of the safe harbor varies. Many statutes void the safe harbor if the decryption key was acquired in the same incident; some define “encryption” specifically (Massachusetts), some treat PCI-DSS-compliant payment data as encrypted (Nevada), and some include redaction or other rendering as equivalent. Hardline encrypts at rest by default in Supabase Postgres and Supabase Storage, encrypts in transit via TLS, and maintains separate access controls for keys; in any incident the Legal Lead documents the precise encryption posture against the state-specific definition.
- AG notice cumulative with consumer notice. Where state AG notice is required, it is in addition to consumer notice, not in lieu of it. AG-notice thresholds (often 500 or 1,000 residents) are usually lower than substitute-notice thresholds. Some states require AG notice before consumer notice (Maryland, New Jersey’s State Police review); some require it concurrently (California, Connecticut, Montana); some require it after (Iowa, Louisiana). Vermont requires an initial preliminary notice to the AG within 14 business days of discovery, before consumer notice. The Legal Lead sequences correctly per the relevant matrix row.
- Federal layer applies regardless.The FTC Safeguards Rule and any other applicable federal sectoral law (HIPAA, GLBA, SEC Reg S-P, CFPB enforcement actions) apply regardless of state requirements. The 30-day FTC clock at 16 C.F.R. § 314.5 runs from discovery and does not pause for ongoing investigation. Hardline files what it knows by day 30 and supplements rather than miss the clock.
The matrix below is sorted alphabetically. Each row captures the most operationally relevant facts as of v1 of this document. “ASAP” is a non-statutory shorthand for “most expedient time possible” or “without unreasonable delay” phrasing. Where a specific cap applies (e.g., 30, 45, 60 days), that cap is shown. Where the trigger event is shown as “Acquisition” or “Access,” the most common formulation in the relevant statute is summarized; the precise statutory language is what controls in any actual analysis.
2.Matrix
| State | Citation | “Personal information” shorthand | Trigger | Consumer notice deadline | AG / regulator notice | Substitute-notice threshold | Encryption safe harbor | Regulator | Unique features |
|---|---|---|---|---|---|---|---|---|---|
| Alabama | Ala. Code § 8-38-1 et seq. | Name + SSN, DL/state ID, financial account + access code, health info, or online credentials | Acquisition + likelihood of substantial harm | ASAP; within 45 days of determination | Yes if > 1,000 residents; to AG within 45 days | > $500,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Alabama Attorney General | Risk-of-harm threshold; written risk assessment must be retained 5 years; CRA notice required if > 1,000 residents |
| Alaska | Alaska Stat. § 45.48.010 et seq. | Name + SSN, DL/state ID, account # + access code, passport, or biometric | Acquisition + reasonable likelihood of harm | Most expedient time possible, without unreasonable delay | No general AG notice requirement | > $150,000 cost, > 300,000 affected, or insufficient contact info | Yes — encrypted data exempt | Alaska Department of Law, Consumer Protection Unit | Risk-of-harm analysis must be in writing and retained 5 years; documented determination of no risk avoids notice |
| Arizona | Ariz. Rev. Stat. § 18-552 | Name + SSN, DL, financial account + access code, medical info, health-ins ID, biometric, e-signature, or online credentials | Acquisition + materially compromises confidentiality | Within 45 days of determination | Yes if > 1,000 residents; to AG and the three CRAs within 45 days | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted, redacted, or secured by another method exempt | Arizona Attorney General | Specific 45-day cap from determination, not from discovery; 'materially compromises' standard |
| Arkansas | Ark. Code § 4-110-101 et seq. | Name + SSN, DL/state ID, account # + access code, medical info, or biometric | Acquisition + reasonable likelihood of harm | Most expedient time, without unreasonable delay | Yes if > 1,000 residents | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt | Arkansas Attorney General | Records-retention policy required by statute; AG notice 'at the time' of consumer notice |
| California | Cal. Civ. Code §§ 1798.29, 1798.82 | Name + SSN, DL/state ID, account/CC + access code, medical info, health-ins info, biometric, tax ID, passport, military ID, genetic data, or online credentials | Unauthorized acquisition | Most expedient time possible, without unreasonable delay | Yes if > 500 residents; sample notice posted to AG website | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | California Attorney General | Mandatory notice form with statutorily-required headings (What Happened / What Information Was Involved / What We Are Doing / What You Can Do / For More Information); CCPA private right of action under § 1798.150 for unencrypted PI; sample notice posted publicly on AG website |
| Colorado | Colo. Rev. Stat. § 6-1-716 | Name + SSN, DL, student/military/passport ID, medical, health-ins, biometric, account # + access code, or online credentials | Acquisition + misuse occurred or reasonably likely | Within 30 days of determination | Yes if > 500 residents; to AG within 30 days | > $250,000 cost, > 250,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Colorado Attorney General | Specific 30-day cap from determination; written information security program separately mandated; CRA notice if > 1,000 residents |
| Connecticut | Conn. Gen. Stat. § 36a-701b | Name + SSN, DL/state ID, account/CC + access code, taxpayer ID, IRS PIN, passport, military ID, alien reg, health-ins, medical info, biometric, or online credentials | Acquisition or access — actual or reasonably believed | Within 60 days of discovery | Yes — to AG concurrently with consumer notice | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Connecticut Attorney General | 24 months of identity-theft prevention services required if SSN involved; 'access' trigger broader than 'acquisition' |
| Delaware | Del. Code tit. 6, § 12B-101 et seq. | Name + SSN, DL, account/CC + access code, passport, taxpayer ID, biometric, medical, health-ins, DNA profile, IRS PIN, or online credentials | Acquisition + reasonable likelihood of harm | Within 60 days of determination | Yes if > 500 residents | > $75,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Delaware Department of Justice | Hardline's state of incorporation; 12 months of credit monitoring required free of charge if SSN involved |
| District of Columbia | D.C. Code § 28-3851 et seq. | Name + SSN, DL/DC ID, account/CC + access code, taxpayer ID, military ID, passport, health-ins, medical, biometric, genetic, or online credentials | Acquisition or access | Most expedient time, no later than 60 days | Yes if > 50 residents; to AG within 60 days | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired or rendered unreadable | D.C. Office of the Attorney General | Low 50-resident AG-notice threshold; 18 months of identity-theft prevention services if SSN or taxpayer ID involved |
| Florida | Fla. Stat. § 501.171 (Florida Information Protection Act) | Name + SSN, DL/state ID, passport, account/CC + access code, medical, health-ins, biometric, taxpayer ID, military ID, or online credentials | Unauthorized access | ASAP, within 30 days of determination | Yes if > 500 residents; to AG within 30 days | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted, secured, or modified data exempt unless key also acquired | Florida Department of Legal Affairs (AG) | Among the strictest in the country: 30-day clock and detailed AG-notice content requirements (forensics report, policies, services offered); 15-day extension available on a showing of good cause |
| Georgia | Ga. Code § 10-1-910 et seq. | Name + SSN, DL, account/CC + access code, or password/PIN | Acquisition + materially compromises security/confidentiality | Most expedient time, without unreasonable delay | No general AG notice requirement | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt | Georgia Office of the Attorney General (no statutory notice) | Narrow PI definition (no medical, biometric); applies primarily to 'information brokers'; CRA notice if > 10,000 residents |
| Hawaii | Haw. Rev. Stat. § 487N-1 et seq. | Name + SSN, DL/state ID, account/CC + access code; SB 2607 (2022) added biometric, online credentials, medical, health-ins, taxpayer ID | Acquisition + reasonable likelihood of harm | Without unreasonable delay | Yes if > 1,000 residents; to AG and OCP | > $100,000 cost, > 200,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Hawaii Office of Consumer Protection | Expanded PI definition under 2022 amendments; written risk assessment recommended |
| Idaho | Idaho Code § 28-51-104 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + reasonable likelihood of misuse | Most expedient time, without unreasonable delay | Only public agencies; private entities not required | > $25,000 cost, > 50,000 affected, or insufficient contact info | Yes — encrypted data exempt | Idaho Office of the Attorney General | One of narrowest PI definitions; risk-of-harm standard; AG-notice obligation only for public agencies |
| Illinois | 815 ILCS 530/1 et seq. (PIPA) | Name + SSN, DL/state ID, account/CC + access code, medical, health-ins, biometric, geolocation history, marital status, gender ID, online credentials, religious affiliation, military discharge type, or taxpayer ID | Acquisition | Most expedient time, without unreasonable delay | Yes if > 500 Illinois residents; to AG within 45 days of discovery | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Illinois Attorney General | Among the broadest PI definitions (includes geolocation, marital status, religious affiliation, gender identity); BIPA overlay for biometric data (740 ILCS 14/); Hardline geofences Illinois in v1 in part due to BIPA exposure |
| Indiana | Ind. Code § 24-4.9-1 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + reasonable likelihood of identity theft or fraud | Without unreasonable delay | Yes — to AG without unreasonable delay | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Indiana Attorney General | AG notice mandatory regardless of size; deceptive act enforceable under Ind. consumer protection statute |
| Iowa | Iowa Code § 715C.1 et seq. | Name + SSN, DL/state ID, account/CC + access code, unique e-ID + access code, or unique biometric | Acquisition + likelihood of harm | Most expedient time, no later than 5 business days after notifying AG | Yes if > 500 residents; to AG within 5 business days of consumer notice | > $250,000 cost, > 350,000 affected, or insufficient contact info | Yes — encrypted, redacted, or secured data exempt unless key also acquired | Iowa Office of the Attorney General | Unusual sequencing: AG notice precedes consumer notice by up to 5 business days; risk-of-harm with documented analysis |
| Kansas | Kan. Stat. § 50-7a01 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + misuse or reasonably likely misuse | Most expedient time, without unreasonable delay | No general AG-notice requirement (although AG enforces) | > $100,000 cost, > 5,000 affected, or insufficient contact info | Yes — encrypted or redacted data exempt unless key also acquired | Kansas Attorney General | Narrow PI; written risk-of-harm analysis recommended; low substitute-notice threshold (5,000 affected) |
| Kentucky | Ky. Rev. Stat. § 365.732 | Name + SSN, DL, or account/CC + access code | Acquisition | Most expedient time, without unreasonable delay | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted or redacted data exempt unless key also acquired | Kentucky Office of the Attorney General | Narrow PI; no AG notice; separate statute (KRS 61.931 et seq.) for state agencies |
| Louisiana | La. Rev. Stat. § 51:3071 et seq. (LDB Act) | Name + SSN, DL/state ID, account/CC + access code, passport, biometric | Acquisition + reasonably believed to cause harm | Within 60 days of discovery | Yes — to AG within 10 days of consumer notice | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted or redacted data exempt unless key also acquired | Louisiana Attorney General | Hard 60-day cap from discovery (one of the firmest in the country); 10-day AG notice; sample notice posting requirement |
| Maine | Me. Rev. Stat. tit. 10, § 1346 et seq. | Name + SSN, DL/state ID, account/CC + access code, or online credentials | Acquisition or release + likelihood of misuse | ASAP, no later than 30 days after determination | Yes — to AG or applicable state regulator within 30 days | > $5,000 cost, > 1,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Maine Attorney General or relevant licensing authority | Low substitute-notice thresholds; financial institutions report to bank regulator instead of AG; ISP-specific privacy rules layered on top |
| Maryland | Md. Code Com. Law § 14-3501 et seq. | Name + SSN, DL/state ID, taxpayer ID, passport, mental/physical health, biometric, account/CC + access code, health-ins, or online credentials | Acquisition + likelihood of misuse | ASAP, no later than 45 days after concluding investigation | Yes — to AG before consumer notice | > $100,000 cost, > 175,000 affected, or insufficient contact info | Yes — encrypted, redacted, or otherwise unreadable data exempt unless key acquired | Maryland Office of the Attorney General | AG notice required before consumer notice (unusual ordering); 30-day max delay for AG to authorize investigation continuation |
| Massachusetts | Mass. Gen. Laws ch. 93H | Resident's name + SSN, DL/state ID, or financial account/CC (with or without access code) | Acquisition or use | ASAP, without unreasonable delay | Yes — to AG, Office of Consumer Affairs, and any affected state regulator | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted or unreadable data exempt; statute defines encryption | Massachusetts Office of Consumer Affairs and Business Regulation; Attorney General | Notice content rules unusual: notice may NOT contain the nature of the breach, the number of residents affected, or detailed forensics — only general categories. 18 months of free credit monitoring required if SSN exposed (36 months for CRA breaches). WISP (201 CMR 17.00) is separately mandatory for any entity holding MA-resident PI |
| Michigan | Mich. Comp. Laws § 445.61 et seq. (Identity Theft Protection Act) | Name + SSN, DL/state ID, or account/CC + access code | Unauthorized access + likely identity theft | Without unreasonable delay | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Michigan Department of Attorney General | Risk-of-harm standard; civil penalty up to $750,000 per breach |
| Minnesota | Minn. Stat. § 325E.61 (consumer), § 325E.64 (CC) | Name + SSN, DL, account/CC + access code; medical info added 2024 | Acquisition | Most expedient time, without unreasonable delay | No general AG-notice requirement (post-2024 amendments under consideration) | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key also acquired | Minnesota Attorney General | Mandates that businesses absorb financial institutions' card-replacement costs in payment-card breaches; recent 2024 amendments expanding PI |
| Mississippi | Miss. Code § 75-24-29 | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + reasonable likelihood of harm | Without unreasonable delay | No general AG-notice requirement | > $5,000 cost, > 5,000 affected, or insufficient contact info | Yes — encrypted data exempt | Mississippi Office of the Attorney General | Low substitute-notice thresholds; documented risk-of-harm determination required to avoid notice |
| Missouri | Mo. Rev. Stat. § 407.1500 | Name + SSN, DL/state ID, financial account + access code, medical, health-ins, or unique biometric | Acquisition + materially compromises security | Without unreasonable delay | Yes if > 1,000 residents | > $100,000 cost, > 150,000 affected, or insufficient contact info | Yes — encrypted or redacted data exempt unless key acquired | Missouri Attorney General | Risk-of-harm standard with materiality test; AG-notice threshold at 1,000 |
| Montana | Mont. Code § 30-14-1701 et seq. | Name + SSN, DL/state ID, account/CC + access code, medical, taxpayer ID, IRS PIN, passport, foreign-gov ID | Acquisition | Without unreasonable delay | Yes — to AG concurrently with consumer notice; e-mail filing accepted | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Montana Office of Consumer Protection | Electronic AG-notice filing portal; consumer notice contents specifically include date range of breach |
| Nebraska | Neb. Rev. Stat. § 87-801 et seq. | Name + SSN, DL/state ID, account/CC + access code, biometric, online credentials | Acquisition + reasonably likely to result in harm | ASAP, without unreasonable delay | Yes — to AG no later than consumer notice | > $75,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted, redacted, or otherwise unreadable; key acquisition negates safe harbor | Nebraska Attorney General | Risk-of-harm with documented written analysis required |
| Nevada | Nev. Rev. Stat. § 603A.010 et seq. | Name + SSN, DL, account/CC + access code, medical ID, health-ins ID, or online credentials | Acquisition | Most expedient time, without unreasonable delay | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt; PCI-DSS-compliant payment data treated as encrypted | Nevada Office of the Attorney General | PCI-DSS treated as encryption proxy for cardholder data; separate SB 220 (2019) opt-out rights for sale of data |
| New Hampshire | N.H. Rev. Stat. § 359-C:19 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition or use + likely misuse | ASAP | Yes — to AG; non-NH businesses notify Attorney General or Consumer Protection Bureau | > $5,000 cost, > 1,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | New Hampshire Department of Justice | Low substitute-notice thresholds; financial institutions report to NH banking regulator |
| New Jersey | N.J. Stat. § 56:8-161 et seq. | Name + SSN, DL/state ID, account/CC + access code, dissociated PI + online credentials (2019 expansion) | Access + reasonable likelihood of misuse | Most expedient time, without unreasonable delay | Yes — to NJ Division of State Police BEFORE consumer notice | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | NJ Division of State Police; Division of Consumer Affairs | Pre-notice State Police review (unusual sequencing); Hardline geofences NJ in v1 for lender-licensing reasons; 2019 amendment expanded PI to online credentials |
| New Mexico | N.M. Stat. § 57-12C-1 et seq. | Name + SSN, DL/state ID, account/CC + access code, or biometric | Acquisition + significant risk of identity theft or fraud | Within 45 days of discovery | Yes if > 1,000 residents; to AG within 45 days | > $100,000 cost, > 50,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | New Mexico Office of the Attorney General | Specific 45-day cap from discovery; significant-risk standard |
| New York | N.Y. Gen. Bus. Law § 899-aa (NY SHIELD Act overlay 2019) | Name + SSN, DL, account/CC + access code, biometric, online credentials, or financial-information-with-account | Access or acquisition (broadened by SHIELD) | Most expedient time, without unreasonable delay | Yes — to AG, Department of State, Division of State Police; if HIPAA-covered, also Department of Health | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | New York Attorney General; NY DFS overlay for financial entities (23 NYCRR 500) | SHIELD Act expanded 'access' trigger; reasonable-safeguards requirement applies to all entities holding NY PI regardless of breach; DFS Part 500 layered cyber regulation for licensed financial institutions; Hardline geofences NY in v1 for lender-licensing reasons |
| North Carolina | N.C. Gen. Stat. § 75-65 | Name + SSN, DL/state ID, account/CC + access code, employer/taxpayer ID, biometric, fingerprints, passwords, parent's birth name, digital signature, e-ID | Acquisition + reasonable likelihood of harm | Without unreasonable delay | Yes — to AG concurrently with consumer notice; specific form requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | North Carolina Department of Justice (AG) | Very broad PI definition (includes parent's birth name, fingerprints, e-IDs); specific AG-notice form with itemized contents |
| North Dakota | N.D. Cent. Code § 51-30-01 et seq. | Name + SSN, DL/state ID, account/CC + access code, employer/taxpayer ID, mother's maiden name, medical, health-ins, or e-signature | Acquisition | Most expedient time, without unreasonable delay | Yes if > 250 residents | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | North Dakota Office of the Attorney General | Low 250-resident AG notice threshold; includes mother's maiden name in PI |
| Ohio | Ohio Rev. Code § 1349.19 | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + materially compromises security | Most expedient time, no later than 45 days after discovery | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Ohio Attorney General | Specific 45-day cap; Ohio Data Protection Act (Ohio Rev. Code § 1354) provides safe harbor in tort litigation for businesses with conforming WISP |
| Oklahoma | Okla. Stat. tit. 24, § 161 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + materially compromises security | Without unreasonable delay | No general AG-notice requirement | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt | Oklahoma Office of the Attorney General | Narrow PI; AG enforces under Oklahoma Consumer Protection Act |
| Oregon | Or. Rev. Stat. § 646A.600 et seq. | Name + SSN, DL/state ID, account/CC + access code, passport, biometric, medical, health-ins, taxpayer ID, or online credentials | Acquisition + reasonable likelihood of identity theft or fraud | Within 45 days of discovery | Yes if > 250 residents; to AG within 45 days | > $250,000 cost, > 350,000 affected, or insufficient contact info | Yes — encrypted data exempt; redaction also exempt | Oregon Department of Justice (AG) | Specific 45-day cap; 250-resident AG threshold; vendor must notify covered entity within 10 days |
| Pennsylvania | 73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act) | Name + SSN, DL/state ID, account/CC + access code, medical, health-ins, or username + password (2023 expansion) | Access + reasonable belief of acquisition | Without unreasonable delay | Yes if > 500 residents (post-2023 amendments) | > $100,000 cost, > 175,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Pennsylvania Office of the Attorney General | 2022-2023 amendments expanded PI to include online credentials and medical info, and added AG-notice requirement at 500-resident threshold; 12 months of credit monitoring required for SSN/DL/account-data breaches in certain circumstances |
| Rhode Island | R.I. Gen. Laws § 11-49.3-1 et seq. | Name + SSN, DL/state ID, account/CC + access code, medical, health-ins, biometric, taxpayer ID, e-signature, or tribal ID | Acquisition + reasonable likelihood of harm | ASAP, no later than 45 days after confirmation | Yes if > 500 residents; to AG and CRAs | > $25,000 cost, > 50,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Rhode Island Office of the Attorney General | Specific 45-day cap; risk-of-harm standard with documented analysis; low substitute thresholds |
| South Carolina | S.C. Code § 39-1-90 | Name + SSN, DL/state ID, account/CC + access code, or other numbers used in combination | Acquisition + materially compromises security | Most expedient time, without unreasonable delay | Yes if > 1,000 residents; to CRAs as well | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt | South Carolina Department of Consumer Affairs | Department of Consumer Affairs (not AG) is the regulator; insurance-sector parallel statute under SC DOI |
| South Dakota | S.D. Codified Laws § 22-40-19 et seq. | Name + SSN, DL/state ID, account/CC + access code, employer/taxpayer ID, biometric, health-ins, or online credentials | Acquisition | ASAP, no later than 60 days after discovery | Yes if > 250 residents | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted, redacted, or otherwise unusable data exempt unless key acquired | South Dakota Office of the Attorney General | Specific 60-day cap; 250-resident AG threshold; one of the most recent statutes (2018) |
| Tennessee | Tenn. Code § 47-18-2107 | Name + SSN, DL/state ID, or account/CC + access code | Acquisition (no harm threshold) | ASAP, no later than 45 days after discovery | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt (statute amended 2017 to clarify) | Tennessee Attorney General | From 2016-2017, Tennessee briefly required notice regardless of encryption; current statute restored encryption safe harbor; 45-day cap |
| Texas | Tex. Bus. & Com. Code § 521.001 et seq. (Texas Identity Theft Enforcement and Protection Act, 'TX BC 521') | Name + SSN, DL/state ID, account/CC + access code, taxpayer ID, IRS PIN, biometric, military ID, e-signature, or unique e-ID + access code | Acquisition | Without unreasonable delay, no later than 60 days after determination | Yes if > 250 Texas residents; to AG within 30 days | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Texas Office of the Attorney General | TX BC 521 has 60-day consumer / 30-day AG-notice clocks (asymmetric); AG-notice content requirements detailed (number of residents, nature of breach, measures taken, mitigation, contact); statute requires written WISP; out-of-state residents may also receive notice under reciprocity |
| Utah | Utah Code § 13-44-101 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + reasonable likelihood of misuse | Most expedient time, without unreasonable delay | No general AG-notice requirement | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt | Utah Office of the Attorney General | Narrow PI; safe harbor for businesses with reasonable WISP under Utah Cybersecurity Affirmative Defense Act (2021) |
| Vermont | 9 V.S.A. § 2430 et seq. | Name + SSN, DL/state ID, account/CC + access code, taxpayer ID, passport, military ID, health-ins, biometric, or DNA | Acquisition or access | ASAP, no later than 45 days after discovery | Yes — to AG (or Dept of Financial Regulation for licensees) within 14 business days of discovery (pre-notice); follow-up after consumer notice | > $5,000 cost, > 5,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Vermont Attorney General; Department of Financial Regulation | 14-business-day preliminary AG notice (one of the earliest); DFR overlay for financial-institution licensees; low substitute-notice thresholds |
| Virginia | Va. Code § 18.2-186.6 | Name + SSN, DL/state ID, or account/CC + access code; tax information added by HB 183 (2017) | Acquisition + reasonably likely to result in identity theft or fraud | Without unreasonable delay | Yes — to AG; medical-info breaches reported to Commissioner of Health | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Virginia Office of the Attorney General | Specific notice to AG and (for medical info) to Commissioner of Health; tax-information breaches reported to AG and Comptroller |
| Washington | Wash. Rev. Code § 19.255.005 et seq. | Name + SSN, DL/state ID, account/CC + access code, full birth date + name, passport, military ID, biometric, health-ins, medical info, or e-signature; 2019 expansion | Acquisition + reasonably believed to compromise security | ASAP, no later than 30 days after discovery | Yes if > 500 residents; to AG within 30 days | > $250,000 cost, > 500,000 affected, or insufficient contact info | Yes — encrypted data exempt unless key acquired | Washington Office of the Attorney General | Specific 30-day cap (among strictest); detailed AG-notice content; 2019 amendments significantly expanded PI definition |
| West Virginia | W. Va. Code § 46A-2A-101 et seq. | Name + SSN, DL/state ID, or account/CC + access code | Acquisition + reasonable likelihood of misuse | Most expedient time, without unreasonable delay | No general AG-notice requirement | > $50,000 cost, > 100,000 affected, or insufficient contact info | Yes — encrypted, redacted, or otherwise unusable data exempt | West Virginia Office of the Attorney General | Narrow PI; risk-of-harm standard; AG enforces under WV Consumer Credit and Protection Act |
| Wisconsin | Wis. Stat. § 134.98 | Name + SSN, DL/state ID, account/CC + access code, DNA profile, or unique biometric | Acquisition | Within 45 days of learning of breach | No general AG-notice requirement (CRAs notified if > 1,000) | Not specified by statute; emailing acceptable for those who consent | Yes — encrypted, redacted, or otherwise altered data exempt | Wisconsin Department of Agriculture, Trade and Consumer Protection | DATCP (not AG) is enforcement agency; specific 45-day cap; DNA profile included in PI |
| Wyoming | Wyo. Stat. § 40-12-501 et seq. | Name + SSN, DL/state ID, account/CC + access code, taxpayer ID, IRS PIN, biometric, birth/marriage certificate, medical, health-ins, individual ID + username/password | Acquisition + likely material harm | Most expedient time, without unreasonable delay | No general AG-notice requirement (although AG may enforce) | > $10,000 cost (in-state), > $250,000 (out-of-state), > 500 in-state affected, or insufficient contact info | Yes — encrypted data exempt | Wyoming Office of the Attorney General | Detailed PI definition (one of broadest); two-tier substitute-notice thresholds for in-state vs. out-of-state entities; statute requires specific contents in consumer notice |
3.Cross-Cutting Themes
A few themes recur across the matrix in ways that change how the Legal Lead structures an incident response in practice:
- Risk-of-harm filter.Roughly half of state statutes incorporate a risk-of-harm filter: notification is required only when the incident is “reasonably likely” to cause “material harm,” “identity theft or fraud,” or similar. These states (Alabama, Alaska, Arkansas, Colorado, Delaware, Indiana, Kansas, Maine, Maryland, Michigan, Mississippi, Missouri, Nebraska, New Mexico, North Carolina, Oklahoma, Utah, Virginia, West Virginia, Wyoming, among others) usually require a written risk assessment to substantiate any decision not to notify; that assessment is itself discoverable in subsequent litigation and is typically retained for five years. Hardline drafts the risk-of-harm analysis under privilege through the Legal Lead.
- Hard deadlines. A subset of statutes impose specific hard caps from discovery or determination: 30 days (Colorado, Florida, Maine, Washington); 45 days (Alabama, Arizona, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Wisconsin); 60 days(Connecticut, Delaware, Louisiana, South Dakota, Texas). Other statutes use only “ASAP / without unreasonable delay” language. Where a 30-day state is in scope, the federal 30-day FTC clock and the state 30-day clock run in parallel and the Legal Lead schedules accordingly.
- Substitute notice. Most statutes allow substitute notice (statewide media plus website plus email-to-known-addresses) when direct notice is infeasible because of cost (typically $5,000 to $250,000), affected-population size (typically 50,000 to 500,000), or lack of contact info. Substitute notice does not relieve the obligation to provide AG notice. Hardline preserves contact info for every borrower and lender precisely so that direct notice remains feasible.
- Content requirements. California, Florida, Maryland, Massachusetts, North Carolina, Texas, and Washington each prescribe specific content for consumer or AG notices. Massachusetts is notably unusual in prohibiting certain content (nature of the breach, number affected) in consumer notice. Hardline maintains state-specific notice templates as appendices to the Incident Response Plan.
- Credit monitoring. Connecticut, Delaware, the District of Columbia, Massachusetts, and Pennsylvania (in defined circumstances) require offering credit monitoring or identity-theft prevention services to affected residents, typically for 12 to 24 months. Hardline pre-negotiates a master agreement with a credit-monitoring provider so that the offering can be stood up within hours of decision.
- CRA notice. A separate notice to the three nationwide consumer reporting agencies (Equifax, Experian, TransUnion) is required in several states when the breach exceeds 1,000 residents (Alabama, South Carolina, Wisconsin), 10,000 (Georgia), or other thresholds. CRA notice is generally not a substitute for AG notice.
- State-specific overlays.Several jurisdictions have non-breach-statute frameworks that nonetheless apply to security incidents: NY DFS Part 500 (23 NYCRR 500) for licensed financial institutions; Massachusetts WISP at 201 CMR 17.00; Illinois BIPA at 740 ILCS 14/ for biometric identifiers; Ohio Data Protection Act safe harbor; Utah Cybersecurity Affirmative Defense Act safe harbor; California Consumer Privacy Act private right of action under Cal. Civ. Code § 1798.150 for unencrypted PI; California SB 1386 history. These overlays may operate in parallel with or partially substitute for the headline breach statute. The Legal Lead checks the overlays as part of every state-specific analysis.
- Insurance-sector overlays.NAIC’s Insurance Data Security Model Law has been adopted (in slightly varying forms) in over twenty states. Hardline is not an insurance licensee, but counterparties to Hardline transactions may be, and the Legal Lead is alert to the possibility that a breach affecting an insurance licensee creates parallel notification rights on Hardline.
4.Federal Layer — Reminder
The FTC Safeguards Rule at 16 C.F.R. § 314.5, effective May 13, 2024, requires that a financial institution subject to the Rule notify the FTC, as soon as possible and no later than 30 days after discovery, of a notification event involving the unauthorized acquisition of unencrypted customer information of 500 or more consumers. The notification must include the elements set out at § 314.5(b): (a) the name and contact information of the reporting financial institution; (b) a description of the types of information involved; (c) the date or date range of the notification event, if the financial institution can reasonably determine it; (d) the number of consumers affected or potentially affected; (e) a general description of the notification event; and (f) whether any law-enforcement official has provided the financial institution with a written determination that notifying the public would impede a criminal investigation or cause damage to national security, and a means for the FTC to contact the official.
Hardline files via the FTC online portal. The 30-day clock is not paused by ongoing investigation. If the elements are not fully known by day 30, Hardline files what is known and supplements promptly. The Legal Lead documents the discovery date in the incident record contemporaneously to avoid later ambiguity about when the clock started.
Additional federal overlays may apply in specific circumstances: SEC Regulation S-P Rule 30 for SEC-registered broker-dealers and investment advisers (Hardline is neither, but lender counterparties may be); HIPAA Breach Notification Rule for PHI (not applicable to Hardline absent a material change in scope); CFPB enforcement authority under Dodd-Frank UDAAP for incidents involving consumer financial information; and the FTC’s general Section 5 UDAP authority over unfair or deceptive security practices.
5.Maintenance and Re-Verification
This matrix is maintained by the Hardline Legal Lead in coordination with outside counsel. It is reviewed at least annually and after any material legislative or regulatory change in any covered jurisdiction. Items that have been the subject of recent or pending legislative activity (e.g., post-2023 amendments in Pennsylvania, post-2024 amendments in Minnesota, post-2022 amendments in Hawaii) are flagged for priority re-verification. Operational use of this matrix in any actual incident is preceded by a state-specific verification by counsel at the time of the incident, including pulling the current statutory text and checking any pending amendments or regulator guidance.
The matrix is published at /legal/breach-notification-matrix as part of Hardline’s broader legal documentation set and is referenced by Section 7 of the Incident Response Plan at /legal/incident-response § 7. Nothing in this matrix constitutes legal advice; nothing in this matrix creates a third-party right or a private right of action; nothing in this matrix modifies any contractual obligation owed by Hardline. The matrix is not a substitute for retaining counsel at the time of an actual incident.
6.Change Log
- 1.0-draft (2026-05-10). Initial pre-launch draft. All 50 states + D.C. captured. Pending licensed-attorney review. Items requiring counsel re-verification before public reliance include: (a) the 2023–2024 amendments to Pennsylvania PIPA; (b) the 2024 amendments to Minnesota Stat. § 325E.61; (c) the 2022 amendments to Hawaii’s breach statute; (d) any 2025 amendments not yet captured; (e) the precise current FTC portal mechanics; (f) the current in-force cyber-insurance policy notice window.