What "breach notification" actually means
Breach notification is the legal duty to tell affected people — and frequently regulators — after their personal or protected data is exposed. The hard part isn't the duty; it's that the duty is defined separately by every US state, by HIPAA, by DoD acquisition rules, by the EU, and by Canada, each with its own trigger, threshold, deadline, recipient, and required content. A single incident touching residents of a dozen states plus PHI can generate twenty-plus distinct obligations on overlapping clocks.
The deadline landscape (2026)
| Regime | Deadline | Notify |
|---|---|---|
| WA / FL / CO / ME state laws | 30 days | Residents (+ AG over threshold) |
| Most other states | "without unreasonable delay" | Residents; 36 states also the AG |
| HIPAA — individuals | ≤ 60 days | Affected individuals |
| HIPAA — 500+ breach | ≤ 60 days | HHS OCR + prominent media |
| GDPR Article 33 | 72 hours | Supervisory authority |
| DFARS 252.204-7012 | 72 hours | DoD via DIBNet |
| SEC Item 1.05 | 4 business days | SEC (8-K), after materiality |
| CIRCIA (covered entities) | 72h / 24h | CISA (incident / ransom payment) |
| PIPEDA (Canada) | "as soon as feasible" | OPC + individuals (RROSH) |
| Québec Law 25 | "with diligence" | CAI + individuals |
Decision-support, not legal advice. Verify with counsel and the current statute before notifying.
The three questions every breach raises
1. Who do I have to tell? Affected individuals always; the state AG in 36 states over a threshold; HHS and the media for large HIPAA breaches; DoD for CUI; an EU supervisory authority for EU residents; the OPC and CAI in Canada. Klaxon's engine resolves this from the data types and per-state resident counts you enter.
2. By when? The clock usually starts at discovery, not at the breach itself — and the earliest applicable deadline governs. Klaxon runs a live countdown on every obligation from the legally correct trigger.
3. In what form? Many states and HIPAA prescribe required content: a description of what happened, the data involved, steps individuals can take, contact information, and — where SSN or financial data is involved — offered credit monitoring (mandated in some states). Klaxon's letter generator assembles jurisdiction-correct letters with the required statutory fields and flags anything missing.
Substitute notice and credit monitoring
When direct notice is infeasible — too many people, no contact info, or cost above a state's threshold — most state laws permit substitute notice: email, a conspicuous website posting, and statewide media. Several states (e.g. Connecticut, California for certain breaches) require offering free credit monitoring when SSNs or financial data are exposed. Klaxon analyzes substitute-notice eligibility and the credit-monitoring requirement automatically.
Why most tools can't help here
Engineering incident tools — incident.io, PagerDuty, FireHydrant, Rootly — are built for Slack war-rooms and on-call, and have zero notification-law awareness. The enterprise privacy platforms that do this well (RadarFirst, BreachRx) are sales-led and cost five to six figures. Klaxon is the first SMB-priced product to put the notification-law engine and the operational incident response in one place. See how it fits a full IR plan →