Data Breach Notification Requirements

Notification triggers vary significantly across jurisdictions, and understanding these differences is critical for determining your obligations. The definition of "personal information" that triggers notification ranges from narrow (name + SSN or financial account number) to broad (any data that could identify an individual). GDPR uses the broadest definition: any data relating to an identified or identifiable natural person.

Encryption safe harbour: Most US state laws and GDPR include an encryption exemption — if the breached data was encrypted and the encryption key was not compromised, notification is not required. This creates a powerful incentive for encryption at rest and in transit, as it effectively eliminates the notification cost category (6% of total breach cost according to IBM) for encrypted data. However, the exemption typically requires demonstrating that the encryption met industry standards (AES-256 or equivalent) and that the key management was adequate.

Risk-of-harm thresholds: Some jurisdictions require notification only when the breach poses a "real risk of significant harm" (Canada) or creates a "risk to rights and freedoms" (GDPR). This risk-based approach allows organizations to avoid notification for low-risk incidents (e.g., encrypted laptop lost but not accessed). However, risk assessment during an active incident is challenging, and regulators have penalized organizations that used risk assessments to avoid notification when the risk was later deemed significant. The safe approach is to err on the side of notification.

Discovery vs awareness triggers: A critical distinction is when the notification clock starts. Most laws start the countdown from "discovery" or "awareness" of the breach, not from when the breach occurred. This means the clock starts when your organization becomes aware of the breach, regardless of how long the breach has been active. Marriott's breach was active for four years before discovery — the notification obligations were triggered by discovery in 2018, not by the initial compromise in 2014. Organizations must have monitoring and detection capabilities to trigger the discovery clock as early as possible.

IBM's cost breakdown attributes 6% of total breach cost to notification — approximately $267,000 for a breach at the $4.44M global average. However, this percentage can be much higher for breaches affecting large numbers of individuals, where per-person costs multiply across millions of records. The major notification cost components include:

For a breach affecting 1 million individuals, notification and credit monitoring alone can cost $10-$33 million — far exceeding the 6% IBM average because mega-breaches drive the per-person cost multiplier. This is why large-scale breaches like Change Healthcare (190M records) and National Public Data (2.9B records) generate such extreme costs: the per-person notification obligation scales linearly regardless of organizational size.

Failing to comply with notification requirements — either by not notifying at all or by notifying late — carries severe penalties that compound already-substantial breach costs. Regulators have become increasingly aggressive in penalizing delayed or inadequate notification, viewing it as a separate violation from the breach itself.

The lesson is clear: timely and complete notification is not optional. Organizations that attempt to minimize or delay notification consistently face more severe regulatory action, larger class action settlements, and greater reputational damage than those that notify promptly and transparently. Uber's $148M settlement for concealing its 2016 breach (paying the attacker $100K to delete data rather than notifying) demonstrates the extreme cost of attempted cover-ups versus transparent disclosure.