UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 9.2 Free with a free account
Laws That Require Organizations to Tell You When Your Personal Data Has Been Compromised
Ethics in Technology · Chapter 9: Data Breaches, Digital Infections, and the Malware EcosystemSection 9.2 · lesson 43 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: What Companies and Individuals Face Legally After a Data Breach Occurs →← How Criminals Target Databases: Common Attack Methods and How to Defend Against ThemNext lesson: What Companies and Individuals Face Legally After a Data Breach Occurs →
In this lesson
Who must be told, which events start the clocks, and how overlapping duties fit together.
- Explain why notification protects affected people and supports accountability.
- Compare state definitions, triggers, safeguards, notice formats, and timing.
- Distinguish HIPAA, SEC, and GDPR recipients and thresholds.
- Apply several duties to a fictional incident without confusing their clocks.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,811 words). Read along, or search it.
Chapter 9
Breach Notification Laws
Breach notification laws give people information they can use after an organization loses control of personal data. The appropriate protective steps depend on the information involved and the possible consequences. Different laws protect affected residents, patients, investors, or people's privacy rights. We first compare the definitions, triggers, safeguards, recipients, and timelines in state laws. Then we examine HIPAA's specific scope and its four-factor compromise assessment. Its individual, regulator, media, and business associate duties have different thresholds. The SEC's incident clock starts after a prompt decision that an incident is material. The GDPR's regulator clock follows awareness, with a different threshold for communicating with individuals. We distinguish discovery, determination, awareness, calendar days, and business days throughout. A fictional retail pharmacy example shows several duties applying to one incident. The goal is accurate, timely, coordinated response, supported by preparation and documented reasoning.
Purpose and Milestones
People Need Timely Information to Protect Themselves
A person cannot take useful protective action about an incident they do not know occurred. Depending on exposure, appropriate steps might include account monitoring, password changes, or a credit freeze. Notification costs, public scrutiny, and possible enforcement also encourage responsible security investment. California enacted its early breach notification law in two thousand two, effective the following year. The two thousand nine HITECH Act established federal health information notification duties. By two thousand eighteen, all fifty states had enacted breach laws, and GDPR began applying. The SEC adopted cybersecurity disclosure requirements in two thousand twenty-three, with phased compliance dates. California's amended consumer notification timing applies from two thousand twenty-six. The United States does not have one general breach notification rule for every kind of personal data. State laws overlap with applicable sector-specific and securities disclosure obligations. An investor may need information about a major disruption even when personal records were not stolen.
State Laws
Compare the Rules for the Affected Residents
Applicable state rules depend on affected residents as well as the organization's legal scope. Headquarters in one state does not automatically limit the response to that state's residents. Many definitions combine a name with sensitive identifiers or financial account access information. Other categories may include medical, insurance, biometric, passport, or account credential information. A credential category may qualify independently, so a name requirement is not universal. Some laws require unauthorized acquisition; others can respond to unauthorized access alone. Encryption exemptions depend on the required protection and whether usable keys or credentials were compromised. Some states permit a documented risk-of-harm exception, while others use different requirements. Additional recipients can include the data owner, attorney general, or consumer reporting agencies. Fixed deadlines, promptness standards, authorized delays, enforcement, and private rights of action also vary. Use the applicable rule's actual definitions and thresholds, rather than copying one state's checklist everywhere.
Triggers and State Clocks
A Security Incident Is Not Automatically a Notifiable Breach
A security incident does not automatically meet every law's definition of a notifiable breach. Examine the data, acquisition or access, encryption conditions, and any permitted harm assessment. A properly encrypted stolen laptop may qualify for an exemption when the required safeguards hold. That conclusion is not a universal exemption under every legal regime. California's ordinary consumer limit is thirty calendar days after discovery or notification of a qualifying breach. For more than five hundred California residents, the attorney general receives a sample notice. Its fifteen-calendar-day clock follows consumer notification, not the end of the consumer deadline. Texas consumer notice is without unreasonable delay, within sixty days after determining that a breach occurred. For at least two hundred fifty Texas residents, attorney general notice is due within thirty days of determination. Specified law enforcement delays and necessary scope or system-integrity work require the applicable conditions. A maximum does not authorize avoidable waiting, and an exception under one law does not automatically delay another.
Plain-Language Notice
Explain Known Facts, Response, and Practical Protection
The source's fictional notice demonstrates California-style headings and clear, practical information. Its first heading explains discovery on March third and access between February twentieth and March second. The information heading identifies names, mailing addresses, and the final four card digits. It states that full card numbers and passwords were not involved. The response heading describes closed access, reset credentials, forensic work, and law enforcement contact. The protection heading suggests appropriate statement review, fraud alerts, or credit freezes. The fictional company also voluntarily offers twenty-four months of credit monitoring. The contact heading supplies a helpline, website, and relevant credit bureau and FTC resources. Those limited data fields alone do not establish California's statutory notification trigger. Permitted electronic or substitute notice has conditions; a website posting alone is not automatically enough. Use legally required contents and delivery, separate known facts from uncertainty, and explain useful protective steps.
HIPAA Scope and Assessment
Assess a Breach of Unsecured Protected Health Information
HIPAA applies to covered entities and their business associates, rather than every health-related product or record. Protected health information, or PHI, has its specific meaning within that framework. Unsecured PHI lacks encryption or destruction meeting the relevant HHS guidance. An impermissible use or disclosure is presumed a breach unless the required basis for an exception exists. A compromise assessment must support a low probability that the information was compromised. First, examine the information's nature and extent, identifiers, and likelihood of re-identification. Second, consider the unauthorized person who used or received it. Third, determine whether the information was actually acquired or viewed. Fourth, assess how far mitigation reduced the risk to that information. Narrow exceptions have conditions, including good-faith unintentional access within authority and limits on further use. An accidental opening is not automatically excused; the organization may instead provide required notice without that assessment.
HIPAA Recipients
Individual, Regulator, Media, and Business Associate Duties Differ
Affected individuals receive HIPAA notice without unreasonable delay, within sixty calendar days after discovery. HHS receives notice on the same ordinary timeline for breaches affecting five hundred or more individuals. Smaller breaches use the annual process, within sixty days after the calendar year ends. Media notification applies to more than five hundred residents within one state or jurisdiction. That notice also must avoid unreasonable delay and ordinarily fall within sixty days after discovery. Business associates notify covered entities without unreasonable delay, within sixty days; contracts can require faster reporting. Covered entities remain responsible even when notice delivery is delegated. HHS publishes reported breaches affecting five hundred or more people, and its Office for Civil Rights enforces duties. Change Healthcare's two thousand twenty-four incident illustrates the coordination demands of a large vendor breach. A July two thousand twenty-five filing estimated approximately one hundred ninety-two point seven million people potentially impacted. That updated the source's earlier estimate, with deduplication limitations; it is not presented as a current universal ranking.
SEC: Investors
A Materiality Decision Starts the Four-Business-Day Clock
Securities disclosure protects investors, so stolen personal information is not a prerequisite. A serious operational disruption can also be material to a covered reporting company. Materiality considers what would matter to a reasonable investor, within the total mix of available information. The company must assess materiality without unreasonable delay after discovering the incident. For covered domestic issuers, Item one point zero five requires reporting within four business days after that determination. The disclosure describes material nature, scope, timing, and impact or reasonably likely impact. Specific technical details that would impede response need not be disclosed under this item. The national security or public safety delay requires the attorney general's determination and written SEC notification. Annual Item one hundred six covers cyber risk management, material effects, management roles, and board oversight. Foreign private issuers have related provisions; four companies settled misleading-disclosure charges in two thousand twenty-four without admissions. Those concerned earlier intrusions, not retroactive use of the new incident item; petitions alone do not change requirements.
GDPR and UK Comparison
Regulator Notification and Individual Communication Have Different Thresholds
GDPR personal data breaches include certain accidental loss, alteration, or unavailability, alongside unauthorized disclosure. A controller documents every breach, even when regulator notification is not required. Required regulator notice must avoid undue delay and, where feasible, arrive within seventy-two hours of awareness. The exception is a breach unlikely to risk people's rights and freedoms. Awareness involves reasonable certainty that a security incident compromised personal data. Communicating with individuals has a different threshold: likely high risk, subject to specific exceptions. That communication must also occur without undue delay. Missing information can follow an initial notice in phases; explain an applicable delay and supplement promptly. A processor informs its controller without undue delay, supporting the controller's decisions and reporting. Territorial scope depends on establishment or relevant EU targeting, not citizenship alone; identify the appropriate authority. UK GDPR is a separate regime with a similar seventy-two-hour reporting requirement to the ICO.
Comparison
Identify the Duty Before Comparing Its Deadline
State laws address their defined personal information and affected residents, with additional recipients under specified conditions. HIPAA concerns unsecured PHI, with separate individual, regulator, and sometimes media duties. SEC reporting addresses material cyber incidents through public investor disclosure. GDPR regulator and individual duties depend on different risk thresholds. Determine the applicable duty before comparing a number in a deadline chart. Discovery, awareness, and a materiality decision are distinct starting events. Calendar days and business days are also different measures of time. One regulator filing does not automatically satisfy another filing or notice to affected people. Apply each regime's conditions and exceptions separately, while coordinating consistent facts and updates. GDPR's seventy-two hours is the shortest listed numeric ordinary limit in the source's comparison. Promptness can demand earlier action, and other applicable laws may impose additional or shorter deadlines.
Worked Example
Northwind Health Retail Faces Several Overlapping Duties
Fictional Northwind Health Retail loses an unencrypted database containing records of forty thousand customers. Assume qualifying state information, a covered pharmacy, and GDPR scope through relevant EU offerings. The groups can overlap; their listed counts are not a complete, disjoint population breakdown. Nine thousand California residents require consumer notice within thirty days of discovery or notification. The attorney general sample follows within fifteen days after notifying those consumers. Three thousand Texas residents bring a sixty-day consumer limit and a thirty-day attorney general limit, from determination. Twelve hundred pharmacy patients bring HIPAA individual and HHS notification duties after discovery. Media notice still depends on more than five hundred residents within one jurisdiction, not the nationwide total. Five hundred German customers require relevant GDPR assessment, regulator notice if needed, and communication if high risk. Other state residents need their applicable rules; the covered reporting company must also assess materiality promptly. Track every actual starting event and prepare the response together, without waiting for the last permissible day.
Readiness and Review
Prepare Decisions, Evidence, Notices, and Updates Before an Incident
Preparation starts with populations, data types, legal scope, recipients, contacts, and reporting channels. Record which event starts each clock and how the required time is measured. Investigate promptly, preserve protected evidence, and assess exposure, safeguards, risk, and materiality. Communicate through the permitted channels with required contents, accurate facts, and practical protective steps. Document assessments, timing, unknowns, applicable delays, delegated work, and required updates. Residence can bring several state rules into the same incident. Qualifying encryption may reduce notice duties, when the relevant legal conditions hold. HIPAA requires its specific low-probability assessment or applicable narrow exception. The SEC's four-business-day clock follows a materiality decision that must not be unreasonably delayed. GDPR's early regulator clock supports readiness, while every other duty retains its own conditions. Notification supports accountable response; practice beforehand, then apply current rules and actual facts when an incident occurs.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Laws That Require Organizations to Tell You When Your Personal Data Has Been Compromised
Is there a federal data breach notification law in the United States?
How long does a company have to notify people after a data breach?
What does HIPAA require after a health data breach?
What are the SEC cybersecurity incident disclosure rules?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →