Walk It Through: The Breach Letter

Notice by the 60th day, the attorney general at 250 residents, and a public list.

A letter arrives saying a store's systems were breached and a customer's information was taken.

Two things a person in this spot might do. Picking one shows what the law says about it.

One breach letter from one store. What counts as personal information, the forms notice may take, and the exception for encrypted data are not worked through here.

A practice walkthrough, not a prediction of how any real one will go. Legal information, not legal advice.

Words this turns on

Terms with a legal meaning that is narrower than the everyday one. Each links to the definition and the authority behind it.

Breach of system securityThe event a person the section covers discloses to each affected individual without unreasonable delay, and not later than the 60th day after determining it occurred. The attorney general is told too when at least 250 residents of this state are involved.