Most US businesses don't have a breach notification deadline. They have dozens. One incident touching customers in forty states puts you on forty different clocks — some starting the moment an analyst spots an odd login in a log, others not formally starting until you've confirmed what was actually taken. The difference between a clean response and two years of attorney general correspondence usually comes down to whether someone mapped those clocks before the incident.

That mapping is harder in 2026 than it was a few years ago. States keep amending definitions, adding regulator notice requirements, and shortening outer limits. At the same time, federal rules — HIPAA, SEC, FTC, and sector-specific regimes — run alongside state statutes. A single ransomware event can trigger consumer notice, attorney general notice, credit reporting agency notice, and in some cases media notice. The businesses that handle it well are not the ones with the best crisis communications; they are the ones with a prebuilt matrix of who must be told what, when, and by whom.

The Default Standard Is Deliberately Vague

Every state, plus the District of Columbia and the US territories, has a breach notification statute. Nearly all of them use the same phrase: notice must go out "without unreasonable delay." That is not a number. It's a standard applied after the fact by a regulator who gets to decide whether your two-week forensic review was reasonable or self-serving.

So most states layer a hard outer limit on top of the vague language. The caps cluster into recognizable tiers, and knowing which tier your customers live in is most of the work.

The vagueness is not an accident. Legislatures wanted flexibility for small businesses with limited forensic resources and for complex intrusions where the scope genuinely takes time to understand. But flexibility cuts both ways. A regulator can treat a 10-day delay as reasonable in one case and unreasonable in another, depending on what you knew, what you documented, and whether you had a plan in place before the incident.

Practical rule: Treat "without unreasonable delay" as a 30-day outer limit even in states with no fixed cap. If you cannot explain the delay in a one-page timeline, it is probably too long.

Where the State Deadlines Cluster

Treat this as a planning map, not a substitute for the statute. Legislatures amend these numbers regularly, and the definitions — especially what counts as "personal information" — shift just as often.

• 30-day caps. Colorado, Florida, Maine, and Washington are among the states with the tightest outer limits. Several also require notice to the state attorney general once a resident-count threshold is crossed. Washington, for example, requires notice to the attorney general when more than 500 residents are affected, and Colorado has its own timing and content rules for AG notice.
• 45-day caps. Arizona, Maryland, Ohio, Oregon, and Vermont sit in this band. Several states in this group also require notice to consumer reporting agencies if the breach affects a large number of residents.
• 60-day caps. Connecticut, Delaware, Louisiana, South Dakota, and Texas allow more time, though "allowed" is not "encouraged." A 60-day cap is an outer limit, not a target.
• No fixed cap. California, New York, and Massachusetts rely on the expediency standard, which in practice means regulators expect prompt notice and will ask why you took as long as you did. New York also has the DFS 72-hour rule for regulated financial entities, and Massachusetts has among the strictest content and documentation expectations in the country.

Then there are the clocks running on a different track. Entities regulated by the New York Department of Financial Services must notify DFS within 72 hours of determining a reportable event. Health care providers and their business associates face a 60-day HIPAA deadline for breaches of unsecured protected health information, plus media notice when 500 or more people in a state are affected. Public companies have their own disclosure timeline under SEC rules once an incident is determined to be material. If you fall into one of those buckets, the state statute is often the slower of the deadlines you're facing.

What Actually Starts the Clock

Discovery, not confirmation. This is where most compliance failures happen. Regulators generally treat the clock as starting when you have facts indicating a breach may have occurred — not when the forensic report lands, not when the outside counsel memo is finalized.

That distinction matters because incident response is messy. A help desk ticket about a phishing email, a spike in failed logins, a vendor's vague warning about "unauthorized

Photo: andibreit / Pixabay