CoolFace
Datasetpublic

referencesource/data-breach-notification-clocks

US state data breach notification deadlines by state Canonical, always-current version: https://referencesource.org/data-breach-notification-clocks/ Machine-readable: https://referencesource.org/data-breach-notification-clocks/data.json — this mirror is a point-in-time copy. Last verified: 2026-08-18 Stale after: 2027-02-14 (past this date, prefer the canonical copy — it re-verifies on a cadence this snapshot does not) Records: 18 US state-by-state data breach notification… See the full description on the dataset page: https://huggingface.co/datasets/referencesource/data-breach-notification-clocks.

sourceHugging Faceotherupdated 26d agoView on Hugging Face
0likes73downloads
Dataset Card

US state data breach notification deadlines by state

Canonical, always-current version: https://referencesource.org/data-breach-notification-clocks/ Machine-readable: https://referencesource.org/data-breach-notification-clocks/data.json — this mirror is a point-in-time copy.

  • —Last verified: 2026-08-18
  • —Stale after: 2027-02-14 (past this date, prefer the canonical copy — it re-verifies on a cadence this snapshot does not)
  • —Records: 18

US state-by-state data breach notification requirements: how many days a business has to notify affected residents after discovering a breach, the deadline and resident-count threshold for notifying the state Attorney General (or equivalent regulator), and the resident-count threshold that triggers notice to consumer reporting agencies. Answers 'how many days to notify after data breach', 'data breach notification deadline [state]', 'when must a company notify the attorney general of a data breach', 'what is the breach notification law in [state]', 'how long does a company have to report a data breach to customers', 'data breach notification requirements by state'. Hard deadlines range from 30 days (California, Florida, Washington) through 45 days (Oregon, Wisconsin) to 60 days (Texas); most states require 'most expedient time possible and without unreasonable delay' with no hard number. No single government page states all 50 states together — each state's statute is the authority — which is why aggregator surveys (Foley, IAPP, Perkins Coie) exist but cite the statutes we read directly. Each record covers one state and its primary breach notification statute.

Provenance — what every record carries

Every record carries source (the URL the value was read from) and source_quote (a verbatim quote from that page stating it). A value you cannot check against its page is indistinguishable from an invented one; these can all be checked. Each record is also individually addressable on the canonical site at its url.

Licence position

State statutes are edicts of government and are not subject to copyright under 17 U.S.C. § 105 (for federal government works) and the equivalent edict-of-government doctrine applied by courts to state legislative materials (Building Officials v. Code Technology, 628 F.2d 730 (1st Cir. 1980); Georgia v. Public.Resource.Org, 590 U.S. 255 (2020)). Short verbatim quotes taken from each statute, attributed to the state and statute citation, for the purpose of stating a fact about the law. No compilation is reproduced wholesale. Facts are not copyrightable (Feist, 1991).

Facts are not copyrightable; what this dataset takes from each source is a fact plus a short attributed quote linking back to the page that states it.

Sources

  • —https://www.azleg.gov/ars/18/00552.htm
  • —https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV
  • —https://leg.colorado.gov/sites/default/files/images/olls/crs2023-title-06.pdf
  • —https://www.flsenate.gov/Laws/Statutes/2023/501.171
  • —https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapterID=67
  • —https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3
  • —https://www.revisor.mn.gov/statutes/cite/325E.61
  • —https://revisor.mo.gov/main/OneSection.aspx?section=407.1500&bid=52524&hl=
  • —https://www.leg.state.nv.us/NRS/NRS-603A.html#NRS603ASec220
  • —https://legislation.nysenate.gov/pdf/bills/2019/S5575B
  • —https://www.ncleg.net/EnactedLegislation/Statutes/HTML/BySection/Chapter75/GS75-65.html
  • —https://codes.ohio.gov/ohio-revised-code/section-1347.12
  • —https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html
  • —https://www.scstatehouse.gov/code/t39c001.php
  • —https://capitol.texas.gov/tlodocs/86R/billtext/pdf/HB04390F.pdf
  • —https://law.lis.virginia.gov/vacode/title18.2/chapter6/section18.2-186.6/
  • —https://app.leg.wa.gov/rcw/default.aspx?cite=19.255.010
  • —https://docs.legis.wisconsin.gov/statutes/statutes/134/98

Fields

See any record in data/records.jsonl — field names are self-describing, and the canonical page for each record renders them with labels: https://referencesource.org/data-breach-notification-clocks/