Data Breach Notification: What Small Businesses Need to Know

When a data breach occurs, the clock starts immediately. Nearly every jurisdiction now requires businesses to notify affected individuals and regulators within a defined timeframe, and failing to do so can result in penalties that dwarf the cost of the breach itself. For small businesses, the challenge is not just responding quickly but understanding which laws apply, who must be told, and what the notification must include. This guide breaks down the core obligations and provides a practical framework for getting it right.

Notification Laws by Jurisdiction

Data breach notification requirements vary significantly depending on where affected individuals are located, not where the business is headquartered. A small business with customers in multiple countries or US states may face overlapping obligations with different deadlines and rules.

United States: A Patchwork of State Laws

There is no single federal breach notification law in the United States. Instead, all 50 states, the District of Columbia, and US territories have enacted their own statutes. Most require notification to affected individuals "without unreasonable delay," but specific timelines vary. Some states set hard deadlines -- for example, 30 days in Florida, 45 days in Ohio, and 60 days in several others. A few states require notification to the state attorney general in addition to affected individuals. Businesses operating across state lines need to identify the strictest applicable deadline and treat it as the default. For businesses managing obligations across multiple regions, understanding multi-jurisdiction privacy compliance is essential.

GDPR: The 72-Hour Rule

Under the General Data Protection Regulation, organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk to those individuals, they must be notified directly as well. The 72-hour window is among the strictest in the world and catches many businesses off guard, particularly those without a prepared response plan.

PIPEDA: "As Soon as Feasible"

Canada's Personal Information Protection and Electronic Documents Act requires organizations to report breaches to the Office of the Privacy Commissioner and notify affected individuals "as soon as feasible" after determining that a breach of security safeguards has occurred involving a real risk of significant harm. Records of all breaches must be maintained for at least two years, regardless of whether they triggered a notification obligation.

Australian Privacy Act

Under the Notifiable Data Breaches scheme, organizations covered by the Australian Privacy Act must notify the Office of the Australian Information Commissioner and affected individuals when a breach is likely to result in serious harm. The assessment must be completed within 30 days of becoming aware of the breach, and notification must follow promptly if the threshold is met.

Who Must Be Notified

Most breach notification laws require communication with two groups: the regulatory authority and the affected individuals whose personal data was compromised.

Regulators. Depending on the jurisdiction, this may mean a state attorney general, a national data protection authority, or a sector-specific regulator. Some laws require notification only when the breach exceeds a certain threshold, such as affecting more than a specified number of individuals.

Affected individuals. Nearly all laws require direct notification to the people whose data was exposed. This typically must be done in writing -- by mail, email, or in some cases through conspicuous website posting if individual contact is not feasible.

Third parties. Certain jurisdictions also require notifying credit reporting agencies when a breach affects a large number of individuals. In the US, this threshold is commonly 500 or 1,000 people, depending on the state.

What a Notification Must Include

While exact requirements differ by jurisdiction, most breach notification laws expect the following elements in a notification to affected individuals:

• A description of what happened, including the date or estimated date of the breach
• The types of personal information involved (names, email addresses, financial data, health records, etc.)
• Steps the business is taking to address the breach and prevent future incidents
• Steps individuals can take to protect themselves, such as monitoring accounts or placing credit freezes
• Contact information for the business, including a way for individuals to ask questions
• Where applicable, contact information for the relevant data protection authority

Notifications to regulators often require additional detail, such as the estimated number of individuals affected, the likely consequences of the breach, and the technical measures in place at the time of the incident.

Common Mistakes in Breach Notification

Delayed Discovery and Response

Many small businesses lack monitoring systems that detect breaches promptly. A breach that goes undetected for weeks or months compresses the notification timeline severely once it is finally discovered. The legal clock typically starts when the business becomes aware of the breach, but regulators take a dim view of organizations that should have discovered it sooner.

Incomplete or Vague Disclosures

Notifications that use generic language without specifying what data was exposed or what individuals should do in response fail to meet legal requirements in most jurisdictions. Vague language also erodes trust. Affected individuals need clear, specific information to take protective action.

Poor Internal Documentation

Failing to document the breach timeline, response actions, and decision-making process is a significant risk. Regulators routinely request evidence of how a breach was handled, when decisions were made, and why certain actions were taken. Without contemporaneous records, a business cannot demonstrate compliance even if it responded appropriately.

Notifying Too Narrowly

Some businesses notify only a subset of affected individuals, either because they underestimate the scope of the breach or because they exclude individuals in jurisdictions they believe are outside their obligations. Underreporting is treated seriously by regulators and can lead to enforcement action.

Breach Notification Checklist

Use this checklist when a breach is suspected or confirmed:

• [ ] Contain the breach immediately -- isolate affected systems, revoke compromised credentials, and preserve evidence
• [ ] Assemble the response team, including IT, legal counsel, and a designated communications lead
• [ ] Document the timeline: when the breach occurred, when it was discovered, and every action taken
• [ ] Assess the scope: what data was affected, how many individuals are involved, and which jurisdictions apply
• [ ] Determine notification obligations based on applicable laws and the nature of the data compromised
• [ ] Draft notification letters for regulators and affected individuals, ensuring all required elements are included
• [ ] Submit regulatory notifications within the required timeframes
• [ ] Send individual notifications using the method required by each applicable law
• [ ] Notify credit reporting agencies if thresholds are met
• [ ] Conduct a post-incident review and update security measures to prevent recurrence
• [ ] Retain all documentation for the period required by applicable laws (at minimum two years)

Response Timeline Template

The following template provides a general framework. Adjust deadlines based on the strictest applicable law.

Hour 0 -- Breach discovered. Activate incident response plan. Contain the breach. Begin documentation.

Hours 0-24. Assemble response team. Begin forensic assessment. Identify what data and which individuals are affected. Engage legal counsel.

Hours 24-48. Complete initial scope assessment. Identify all applicable notification laws and their deadlines. Begin drafting notifications.

Hours 48-72. Finalize and submit regulatory notifications where a 72-hour deadline applies (GDPR). Continue refining scope assessment for other jurisdictions.

Days 3-30. Send individual notifications. Submit regulatory notifications for jurisdictions with longer deadlines. Notify credit reporting agencies if required. Continue forensic investigation.

Days 30-90. Complete post-incident review. Implement corrective measures. Update the incident response plan based on lessons learned. Ensure all required documentation is retained.

This timeline assumes the breach is discovered promptly. Businesses without monitoring and detection capabilities should treat establishing those systems as a priority, since a breach that goes undetected for months makes compliance with any notification deadline extremely difficult.