United States of America

The United States has no single federal data breach notification law. Instead, every one of the 50 states has had its own breach-notification statute since 2018, each with its own trigger, deadline and definition of "affected". Two federal sector rules layer on top for specific industries: the HIPAA Breach Notification Rule requires a healthcare entity to notify affected individuals of a breach of unsecured protected health information no later than 60 calendar days after discovery, and HHS OCR at the same time when 500 or more people are affected (smaller breaches are reported to HHS once a year), and SEC Form 8-K Item 1.05 requires a public company to disclose a material cybersecurity incident within four business days of determining it is material.