Question 1

Do I have to notify the state attorney general of a data breach?

Accepted Answer

In 36 states you must notify the state attorney general (or a designated regulator) once a breach exceeds that state's resident threshold. Klaxon's engine checks each affected state's threshold and tells you exactly which AG notices are triggered, with deadlines and letter templates.

Question 2

What is the HIPAA breach notification deadline?

Accepted Answer

Affected individuals must be notified without unreasonable delay and no later than 60 days from discovery. Breaches affecting 500 or more individuals also require HHS OCR and prominent media notice within 60 days; smaller breaches go on the annual HHS log due within 60 days of year-end.

Question 3

What is the GDPR and DFARS 72-hour rule?

Accepted Answer

GDPR Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a personal-data breach. DFARS 252.204-7012 requires defense contractors to report a cyber incident to DoD via DIBNet within 72 hours of discovery. Klaxon runs both clocks from the legally correct trigger.