The best way to prepare for a data breach is to have a written, tested incident response plan in place before anything goes wrong: a named response team, outside counsel and a forensic firm lined up in advance, and a map of every notification deadline that could apply to your business. Breach notification laws start the clock when an incident is discovered, not when the investigation is finished. Companies that plan ahead contain incidents faster, meet their legal deadlines, and give regulators and plaintiffs far less to work with.
This guide focuses on readiness: what to build now so your business can respond well under pressure. If you want the financial and liability side of the picture, see our companion article on the cost and legal exposure of a data breach.
Why Breach Readiness Is a Legal Issue, Not Just an IT Issue
Every U.S. state now has a breach notification law. According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands require private businesses to notify individuals of security breaches. A business with customers in many states may face dozens of overlapping statutes, each with its own definition of personal information, its own content requirements, and in some cases its own regulator notice.
Federal rules add further layers depending on your industry. A company that treats a breach as purely a technical problem, and calls a lawyer only after the forensic work is done, often finds that important deadlines have already passed.
Step 1: Know Which Notification Laws Apply to You
Start with an inventory of the personal information you collect, where it lives, and which states your customers and employees reside in. Then build a notification matrix. Common triggers include:
- State breach notification statutes. These generally apply based on where affected individuals live, not where your business is located. Our overview of when companies must provide data breach notification explains the common elements, and our state guides cover the Illinois data breach notification law and others.
- The FTC Safeguards Rule (16 C.F.R. Part 314). Non-bank financial institutions under FTC jurisdiction, such as mortgage brokers, finance companies, collection agencies, tax preparation firms and many auto dealers, must notify the FTC of a qualifying incident. The requirement took effect May 13, 2024.
- HIPAA. Covered entities must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovering a breach of unsecured protected health information (45 C.F.R. § 164.404).
- SEC disclosure rules. Public companies must disclose material cybersecurity incidents on Form 8-K under Item 1.05.
- Contracts. Payment card processing agreements, vendor contracts, data processing agreements and cyber insurance policies often impose their own notice obligations and deadlines.
Michigan Businesses: The Identity Theft Protection Act
Michigan’s breach notice requirement appears in MCL 445.72, part of the Identity Theft Protection Act. A business that owns or licenses the affected data must notify Michigan residents whose unencrypted personal information was accessed and acquired by an unauthorized person, unless it determines, acting with ordinary prudence, that the breach is not likely to cause substantial loss or injury or result in identity theft. Notice must be given without unreasonable delay. The statute allows a delay only to determine the scope of the breach and restore the reasonable integrity of the database, or when law enforcement advises that notice would impede an investigation.
If a business must notify more than 1,000 Michigan residents, it must also notify the nationwide consumer reporting agencies (with an exception for entities subject to the Gramm-Leach-Bliley Act). A person that knowingly fails to give required notice may be ordered to pay a civil fine of up to $250 per failure, capped at $750,000 in the aggregate for a single breach. Our Michigan data breach notification law guide covers the statute in more detail.
The FTC Safeguards Rule 30-Day Reporting Requirement
Under the amended Safeguards Rule, a covered financial institution must notify the FTC as soon as possible, and no later than 30 days after discovery, of a “notification event” involving the information of at least 500 consumers. A notification event is the acquisition of unencrypted customer information without the authorization of the individual to whom it pertains. Reports are submitted through an online form, and the FTC has stressed that this requirement does not replace other state or federal obligations.
Public Companies: Form 8-K Item 1.05
The SEC’s cybersecurity disclosure rules, adopted July 26, 2023, require public companies to disclose a cybersecurity incident on Form 8-K within four business days after determining that the incident is material. The materiality determination itself must be made without unreasonable delay after discovery. A readiness plan for a public company should therefore include a defined process, and decision-makers, for assessing materiality quickly.
Step 2: Build a Written Incident Response Plan
A plan that sits in a drawer is better than nothing, but a legally defensible plan is specific. At a minimum it should address:
- Roles and authority. Name the incident lead, the executive decision-maker, IT and security leads, legal, communications, and HR, with backups for each. Spell out who can authorize taking systems offline, contacting law enforcement, or paying outside vendors.
- Detection and escalation. Define what counts as a reportable incident internally and how quickly employees must escalate it. Many breaches come to light through an employee, a customer complaint, or a vendor, so the escalation path has to reach beyond the IT team.
- Evidence preservation. Instruct teams to preserve logs, images and affected devices rather than wiping and rebuilding systems before the forensic work is done.
- Notification decision-making. Tie your notification matrix to a checklist for deciding who must be notified, by when, and with what content.
- Communications. Pre-approve holding statements and designate a single spokesperson. Off-the-cuff statements by employees can create inconsistent records and added exposure.
Step 3: Line Up Counsel, Forensics and Insurance Before You Need Them
The first 72 hours of an incident are the wrong time to negotiate engagement letters. Identify and engage outside data breach counsel in advance, and agree on a forensic firm that can deploy quickly. Many companies structure the forensic engagement through counsel to support claims of attorney-client privilege and work product protection over the investigation. That protection is not automatic, and it depends on how the engagement is actually structured and used, so work it out before an incident rather than during one.
Review your cyber insurance policy now. Policies commonly require prompt notice to the carrier and may require you to use approved vendors. A mismatch between your plan and your policy can jeopardize coverage.
Step 4: Manage Vendor and Third-Party Risk
Many incidents begin with a vendor, such as a payment processor, a cloud host, a marketing platform or a managed IT provider. Michigan’s statute, like many others, requires a business that maintains data it does not own to notify the owner or licensor of a breach, which means you depend on your vendors to tell you quickly. Your contracts should require prompt breach notice, cooperation with investigations, reasonable security controls, and allocation of notification costs. Our article on third-party data breaches explains why vendors are often the weakest link.
Step 5: Test the Plan With Tabletop Exercises
Run a tabletop exercise at least once a year, and again after major system or personnel changes. Walk the team through a realistic scenario, such as ransomware on a customer database or a compromised employee email account, and time how long it takes to escalate, engage counsel, reach a notification decision, and draft notices. Record the gaps and update the plan. Regulators and courts evaluating whether a company acted reasonably will look at what it did before the breach, not just after.
Preparation Is the Best Breach Defense
A breach is stressful even for well-prepared companies. But businesses that have mapped their notification obligations, built a specific response plan, pre-arranged counsel and forensics, and practiced the process are far better positioned to meet short legal deadlines and limit their exposure.
If your business needs to build or update an incident response plan, or is responding to a security incident right now, the data breach attorneys at Revision Legal can help you prepare, meet notification deadlines, and deal with regulators. Contact us through the form on this page or call (855) 473-8474.
