The Uptime report

Locked filing cabinets beside a closed network cabinet in a small office back room

Data Security Compliance: Which Rule Covers Your Data, What It Requires, and How Fast You Must Report a Breach

By The Uptime Report Team · Last reviewed: October 2026

Data security compliance means meeting the security rule attached to each type of data you hold: HIPAA for patient records, PCI DSS for card numbers, the FTC Safeguards Rule for consumer financial data and GDPR for EU residents.

Key takeaways

  • GDPR requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach. Breaches of the security and notice articles (32 to 34) fall in the Art. 83(4) tier of up to €10,000,000 or 2% of turnover; the €20 million or 4% tier applies only if the regulator also finds a breach of the Art. 5(1)(f) security principle (GDPR Art. 83).
  • HIPAA gives covered entities no more than 60 calendar days after discovery to notify individuals, and encryption under 45 CFR 164.312 is still labelled “addressable” as of October 2026 (45 CFR 164.404).
  • Non-bank financial firms must tell the FTC within 30 days of discovering a breach of 500 or more consumers’ unencrypted data, a duty in force since May 13, 2024 (88 FR 77499).
  • California requires breach notice within 30 calendar days of discovery since January 1, 2026 (Cal. Civ. Code 1798.82).
  • CMMC Level 2 equals the 110 requirements of NIST SP 800-171 Rev. 2, not Rev. 3, and a July 13, 2026 DoD CIO memo suspended the Phase 2 certificate transition, as implemented by DoD class deviation 2026-O0025.
  • An MSP or other vendor holding a client’s data must notify the owner “immediately” in Washington, California, Texas and Maine and within 10 days in Florida, before the client’s own 30 or 60-day clock (Fla. Stat. 501.171(6)).
72 hours
GDPR deadline to notify the supervisory authority of a breach
GDPR Art. 33(1), accessed October 2026
30 days
FTC notice after a breach of 500+ consumers’ unencrypted data
16 CFR 314.4(j), May 2024
60 days
HIPAA outer limit to notify affected individuals
45 CFR 164.404, accessed October 2026

What is data security compliance?

Data security compliance is meeting the security controls and breach-reporting duties that a law, regulation or contract attaches to a specific type of data. The rule follows the data: patient records fall under the HIPAA Security Rule at 45 CFR 164.312, card numbers under PCI DSS v4.0.1, and EU residents’ personal data under GDPR Article 32, whatever your industry.

Laws and regulations, such as HIPAA, the FTC Safeguards Rule at 16 CFR Part 314 and GDPR, carry regulator enforcement and statutory penalties. Industry standards work through contracts: the PCI Security Standards Council says whether an entity must comply with PCI DSS is “at the discretion of organizations that manage compliance programs,” naming payment brands and acquirers.

Privacy rules decide whether you may collect and use personal data; security rules decide how you protect it. GDPR holds both: Articles 5 to 22 cover principles and data subject rights, Articles 32 to 34 cover security and breach notice, and the two sit in different fine tiers under GDPR Article 83. The line blurs at Art. 5(1)(f), a principle that itself requires “appropriate security of the personal data” (GDPR Art. 5).

Security compliance frameworks such as ISO/IEC 27001:2022 (October 2022), the NIST Cybersecurity Framework 2.0 (February 26, 2024) and SOC 2 become duties only when a contract or regulation cites them, and passing an audit against one is not the same as being protected.

Which data security compliance rule applies to the data you hold?

Find the rule by the data, not by your industry label. A dental office that takes cards and keeps electronic patient charts answers to both HIPAA and PCI DSS; a mortgage broker holding customer files answers to the FTC Safeguards Rule. The table maps nine data types to the governing rule, the section that sets the security controls, and the body that enforces it.

Data you hold Governing rule Section that sets the controls Enforced by Source
Patient health records (ePHI) at providers, health plans, clearinghouses and their business associates HIPAA Security Rule, 45 CFR 164.312 45 CFR 164.308 (administrative) and 164.312 (technical) HHS Office for Civil Rights eCFR, 45 CFR 164.312
Payment card numbers (PAN) and sensitive authentication data PCI DSS v4.0.1, Requirements 3 and 4 Requirement 3 (stored account data) and Requirement 4 (strong cryptography in transmission over open, public networks) Payment brands and acquirers, by contract PCI SSC, SAQ D (v4.0 form; numbering unchanged in v4.0.1)
Consumer financial data, non-bank: mortgage brokers, motor vehicle dealers, payday lenders FTC Safeguards Rule, 16 CFR 314.4 (Gramm-Leach-Bliley Act) 16 CFR 314.4(a) to (j) Federal Trade Commission FTC, Oct 2023
Defense CUI (Controlled Unclassified Information) on DoD contracts DFARS 252.204-7012, NIST SP 800-171 Rev. 2, 32 CFR 170 (CMMC) The 110 NIST SP 800-171 Rev. 2 requirements (CMMC Level 2) DoD contracting officers eCFR, 32 CFR 170.14
Student education records FERPA, 34 CFR Part 99 34 CFR 99.31(a)(1)(ii): “reasonable methods” to limit access Department of Education, Student Privacy Policy Office eCFR, 34 CFR 99.31
Personal data of people in the EU, including at non-EU firms that offer them goods or services (Art. 3(2)) GDPR Articles 32 to 34 Art. 32 security of processing; Art. 33 and 34 breach notice National supervisory authorities EUR-Lex, Regulation 2016/679
California residents’ personal information Cal. Civ. Code 1798.81.5 and 1798.82 1798.81.5(b): “reasonable security procedures and practices” Notices go to residents and, above 500, the Attorney General; consumers may sue under 1798.150 California Legislature
Bank systems and services 12 CFR 53.3 and 53.4 (OCC), with parallel FDIC and Federal Reserve rules Incident notice duties for banks and bank service providers OCC, FDIC, Federal Reserve eCFR, 12 CFR 53.3
Material incident at a public company SEC Form 8-K Item 1.05, Reg. S-K Item 106 17 CFR 229.106 (risk management and governance disclosure) Securities and Exchange Commission eCFR, 17 CFR 229.106; our Item 1C study

What security controls does each rule require?

The five rules with written control lists cover the same eight controls but differ on how firm each duty is. PCI DSS v4.0.1, the FTC Safeguards Rule and NIST SP 800-171 Rev. 2 make encryption and multi-factor authentication mandatory. The HIPAA Security Rule still labels encryption “addressable,” and GDPR Article 32 leaves both to a risk-based judgement.

Control HIPAA PCI DSS v4.0.1 FTC Safeguards GDPR NIST 800-171 Rev. 2 Source
Written risk assessment Required, 164.308(a)(1)(ii)(A) Required, 12.3.1 targeted risk analysis Required, 314.4(b)(1); waived under 5,000 consumers Risk-based, Art. 32(1) Required, 3.11.1 45 CFR 164.308; 16 CFR 314.4
Encryption at rest Addressable, 164.312(a)(2)(iv) Required, 3.5.1 (PAN rendered unreadable) Required, 314.4(c)(3) Risk-based, Art. 32(1)(a) Required, 3.13.16; FIPS-validated per 3.13.11 45 CFR 164.312; NIST SP 800-171 Rev. 2
Encryption in transit Addressable, 164.312(e)(2)(ii) Required, 4.2.1 Required, 314.4(c)(3) Risk-based, Art. 32(1)(a) Required, 3.13.8 PCI SSC SAQ D
Multi-factor authentication Not specified; 164.312(d) requires verifying identity Required, 8.4.2 (all access into the CDE) Required, 314.4(c)(5) Not specified Required, 3.5.3 PCI SSC SAQ D
Audit logging Required, 164.312(b) Required, 10.2.1; 12 months retention, 10.5.1 Required, 314.4(c)(8) Not specified Required, 3.3.1 45 CFR 164.312
Vulnerability scans, pen tests Not specified Required: scans every three months (11.3.1, 11.3.2); external pen test every 12 months (11.4.3) Required: annual pen test and scans every six months unless continuous monitoring is in place, 314.4(d)(2); waived under 5,000 consumers Risk-based, Art. 32(1)(d) regular testing Required, 3.11.2 16 CFR 314.4
Incident response, breach records Required, 164.308(a)(6)(ii) Required, 12.10.1 Required, 314.4(h); waived under 5,000 consumers Required, Art. 33(5) breach records Required, 3.6.1 GDPR
Vendor oversight Required, 164.308(b)(1) business associate assurances Required, 12.8.2 written agreements Required, 314.4(f) Required, Art. 28(1) Required via DFARS 252.204-7012(m) flow-down DFARS 252.204-7012
Which data security rules require which controlsStatus in the rule text as of October 2026HIPAAPCI DSS v4.0.1FTC SafeguardsGDPRNIST 800-171 Rev. 2Written risk assessmentRequiredRequiredRequiredRisk-basedRequiredEncryption at restAddressableRequiredRequiredRisk-basedRequiredEncryption in transitAddressableRequiredRequiredRisk-basedRequiredMulti-factor authenticationNot specifiedRequiredRequiredNot specifiedRequiredAudit loggingRequiredRequiredRequiredNot specifiedRequiredVulnerability scans, pen testsNot specifiedRequiredRequiredRisk-basedRequiredIncident response, breach recordsRequiredRequiredRequiredRequiredRequiredVendor oversightRequiredRequiredRequiredRequiredRequiredRequiredAddressableRisk-basedNot specified
Which data security rules require which controls (status in the rule text as of October 2026): PCI DSS v4.0.1, the FTC Safeguards Rule and NIST SP 800-171 Rev. 2 require all eight controls; HIPAA leaves encryption addressable and GDPR leaves most controls risk-based. Sources: eCFR, PCI SSC SAQ D, GDPR, NIST; accessed October 2026.

What does “addressable” mean under HIPAA?

Addressable does not mean optional. Under 45 CFR 164.306(d)(3), a covered entity or business associate must assess each addressable specification, implement it if reasonable and appropriate, or document why not and implement an equivalent alternative. HHS published a proposed rule on January 6, 2025 that would change this, but no final rule had appeared in the Federal Register when we checked in October 2026.

Encryption also decides whether an incident becomes a reportable breach. HIPAA notice duties attach to “unsecured protected health information” (45 CFR 164.402), the FTC defines a notification event as acquisition of unencrypted customer information (16 CFR 314.2), and Washington’s law covers personal information that “was not secured” (RCW 19.255.010). Encrypted data stays outside those triggers unless the key was taken too.

What changed for card data and defense CUI?

For card data, PCI DSS v4.0.1, published by the PCI Security Standards Council on June 11, 2024, added and deleted none of the 12 PCI DSS requirements; v4.0 retired on December 31, 2024, and the future-dated requirements took effect on March 31, 2025 (PCI SSC blog).

For defense CUI, the control set is NIST SP 800-171 Rev. 2, not the newer Rev. 3. 32 CFR 170.14(c)(3) says CMMC Level 2 requirements “are identical to the requirements in NIST SP 800-171 R2,” and a DoD class deviation signed September 3, 2026 still requires “baseline compliance with NIST SP 800-171 Rev 2.” That baseline matters at scale: DoD expects 118,289 contractors to need Level 2, according to our CMMC certification statistics.

Revision Published Requirements Families Status for DoD contracts Source
NIST SP 800-171 Rev. 2 February 2020, updated January 28, 2021 110 14 Baseline for DFARS 252.204-7012 and CMMC Level 2 NIST
NIST SP 800-171 Rev. 3 May 2024 97 active; 33 identifiers withdrawn (our count) 17 Not the CMMC baseline as of October 2026 NIST

Who does each rule apply to, and what are the size thresholds?

Most data security rules apply from the first record, but several change your duties at a numeric threshold: 500 or more affected people for HIPAA HHS notice and FTC notice, more than 500 residents of one state for HIPAA media notice, 5,000 consumers for the Safeguards Rule’s small-firm exemption, and state attorney general thresholds listed in the state table below. The table lists each trigger with its section.

Rule Applies to Threshold What changes at the threshold Source
HIPAA Covered entities and business associates 500 or more individuals in one breach HHS notified at the same time as individuals (164.408(b)); under 500, log and report within 60 days after the end of the calendar year (164.408(c)) 45 CFR 164.408
HIPAA Covered entities More than 500 residents of one state Prominent media outlets in that state notified within 60 calendar days 45 CFR 164.406
FTC Safeguards Rule Non-bank financial institutions At least 500 consumers in a notification event FTC notified within 30 days of discovery, effective May 13, 2024 88 FR 77499
FTC Safeguards Rule Same Customer information on fewer than 5,000 consumers Exempt from 314.4(b)(1), (d)(2), (h) and (i) only 16 CFR 314.6
Florida breach law Covered entities 500 or more individuals in Florida Department of Legal Affairs notified within 30 days of determining the breach; individual notice may get 15 more days for good cause given to the Department in writing Fla. Stat. 501.171(3)
CMMC Level 2 DoD contractors handling CUI Score of at least 0.8 of 110, or 88 points Conditional status with a POA&M that must close within 180 days 32 CFR 170.21; 170.16
Bank service providers Service providers to OCC-regulated banks Disruption of covered services for four or more hours Notify the bank’s designated contact as soon as possible 12 CFR 53.4

No rule here exempts a firm for having few employees. The FTC’s 5,000-consumer cut-off counts records and leaves encryption (314.4(c)(3)), MFA (314.4(c)(5)) and the 30-day FTC notice in force (16 CFR 314.6).

How fast must you report a data breach under each rule?

Breach reporting deadlines run from 36 hours to 60 days, and each starts at a different moment. Banks have 36 hours from deciding a notification incident occurred; GDPR controllers and DoD contractors have 72 hours; public companies have four business days after deciding an incident is material; HIPAA covered entities have up to 60 calendar days after discovery. Each clock runs separately.

Who notifies whom Deadline Clock starts at Rule Source
Bank to its federal regulator 36 hours Determining a notification incident occurred 12 CFR 53.3 eCFR
GDPR controller to supervisory authority 72 hours, without undue delay and where feasible Becoming aware of the breach GDPR Art. 33(1) EDPB Guidelines 9/2022
GDPR processor to controller Without undue delay Becoming aware of the breach GDPR Art. 33(2) EUR-Lex
Defense contractor to DoD 72 hours, via dibnet.dod.mil Discovery of a cyber incident DFARS 252.204-7012 eCFR
Public company Form 8-K 4 business days Determining the incident is material SEC Item 1.05 SEC; our Item 1.05 tracker
Non-bank financial firm to FTC 30 days, if 500+ consumers Discovery 16 CFR 314.4(j) eCFR
Washington residents and AG 30 days (30 calendar days); AG only if more than 500 residents Discovery RCW 19.255.010 Washington Legislature
California residents 30 days (30 calendar days, since January 1, 2026); delay allowed only for law enforcement or to scope the breach Discovery or notification Cal. Civ. Code 1798.82 California Legislature
Florida individuals and Dept. of Legal Affairs 30 days; Dept. of Legal Affairs only if 500+ Determination of the breach Fla. Stat. 501.171 Florida Legislature
HIPAA individuals, media, HHS (500+) 60 days (60 calendar days) Discovery 45 CFR 164.404 to 164.408 eCFR
HIPAA business associate to covered entity 60 days (60 calendar days) Discovery 45 CFR 164.410 eCFR
HIPAA covered entity to HHS, under 500 people 60 days after the end of the calendar year End of the calendar year 45 CFR 164.408(c) eCFR
Outer deadline to report a data breach, by ruleBar length in days from the trigger event; shorter bars mean less time30 days60 daysBank to its federal regulator12 CFR 53.336 hoursGDPR controller to supervisory authorityGDPR Art. 33(1)72 hoursDefense contractor to DoDDFARS 252.204-701272 hoursPublic company Form 8-KSEC Item 1.054 business daysNon-bank financial firm to FTC16 CFR 314.4(j)30 daysWashington residents and AGRCW 19.255.01030 daysCalifornia residentsCal. Civ. Code 1798.8230 daysFlorida individuals and Dept. of Legal AffairsFla. Stat. 501.17130 daysHIPAA individuals, media, HHS (500+)45 CFR 164.404 to 164.40860 daysHIPAA business associate to covered entity45 CFR 164.41060 daysSEC clock starts when the company determines the incident is material, not at discovery.
Outer deadline to report a data breach, by rule (bar length in days from the trigger event; shorter bars mean less time). The SEC clock starts when the company determines the incident is material, not at discovery. Deadlines range from 36 hours (12 CFR 53.3) to 60 calendar days (45 CFR 164.404); four rules allow 30 days. Sources: eCFR, GDPR, SEC, Washington, California and Florida statutes; accessed October 2026.

Real filings run well past these limits. In 1,675 notices filed with Washington’s Attorney General, the 2025 median from discovery to notice was 134 days, and 87% of 2025 notices came after day 30 (our analysis of how long companies take to report a data breach). Washington allows delay for law enforcement or scoping, and the dataset does not record which notices used it.

Which states set a fixed number of days?

Among the 11 state breach statutes we read at the official source, California, Florida, Maine and Washington allow 30 days, Arizona, Maryland and Vermont allow 45, and Connecticut, Delaware, Louisiana and Texas allow 60. Some clocks start at discovery and others at the determination that a breach occurred, so record both dates on day one.

State Statute Deadline to residents Clock starts at Regulator notice Source
California Cal. Civ. Code 1798.82 30 calendar days Discovery or notification Attorney General sample copy if more than 500 residents, within 15 calendar days of notifying them California Legislature
Florida Fla. Stat. 501.171 30 days Determination of the breach Department of Legal Affairs if 500 or more, within 30 days Florida Legislature
Maine 10 M.R.S. 1348 30 days Becoming aware of the breach and identifying its scope Not reviewed Maine Legislature
Washington RCW 19.255.010 30 calendar days Discovery Attorney General if more than 500, within 30 days Washington Legislature
Arizona A.R.S. 18-552 45 days Determination of the breach Attorney General and Arizona Department of Homeland Security if more than 1,000, within the same 45 days Arizona Legislature
Maryland Md. Code, Com. Law 14-3504 45 days Discovery or notification Attorney General, before notifying individuals Maryland General Assembly
Vermont 9 V.S.A. 2435 45 days Discovery or notification Attorney General preliminary notice within 14 business days Vermont Legislature
Connecticut Conn. Gen. Stat. 36a-701b 60 days Discovery Attorney General, no later than the resident notice Connecticut General Assembly
Delaware 6 Del. C. 12B-102 60 days Determination of the breach Attorney General if more than 500, no later than the resident notice Delaware Code
Louisiana La. R.S. 51:3074 60 days Discovery Not reviewed Louisiana Legislature
Texas Tex. Bus. & Com. Code 521.053 60 days Determination that the breach occurred Attorney General if 250 or more, within 30 days Texas Legislature

What does an MSP or other vendor owe its clients after a breach?

An MSP’s clock usually runs before its client’s. A HIPAA business associate has up to 60 calendar days to tell the covered entity, a GDPR processor must tell the controller “without undue delay,” Washington, California, Texas and Maine require a vendor holding someone else’s data to notify the owner immediately, and Florida gives a third-party agent 10 days. The table lists each vendor duty with its citation.

Rule Vendor role Vendor clock What follows What else the vendor must do Citation
HIPAA Business associate: maintains or transmits ePHI for a provider or plan Business associate to covered entity: 60 days Covered entity to individuals: 60 days Identify each affected individual (164.410(c)(1)); work under a business associate agreement (164.308(b)(1)) 45 CFR 164.410
GDPR Processor Processor to controller: without undue delay Controller to authority: 72 hours Assist the controller with Articles 32 to 36 (Art. 28(3)(f)) and allow audits (Art. 28(3)(h)) GDPR Art. 28; Art. 33(2)
Florida Third-party agent Third-party agent to covered entity: 10 days Covered entity to individuals: 30 days Give the covered entity all information it needs for its notices Fla. Stat. 501.171(6)
Washington Vendor that maintains data it does not own Vendor to data owner: immediately Owner to residents: 30 days Clock runs from discovery RCW 19.255.010(2)
California Vendor that maintains data it does not own Vendor to data owner: immediately Owner to residents: 30 days Clock runs from discovery Cal. Civ. Code 1798.82(b)
Texas Vendor that maintains data it does not own Vendor to data owner: immediately Owner to residents: 60 days Clock runs from discovery Tex. Bus. & Com. Code 521.053(c)
Maine 3rd-party entity that maintains data it does not own Vendor to data owner: immediately Owner to residents: 30 days Clock runs from discovery 10 M.R.S. 1348(2)
Banks Bank service provider Service provider to bank: as soon as possible Bank to regulator: 36 hours Applies when covered services are disrupted or degraded for four or more hours; notify the bank-designated contact, or the CEO and CIO if none 12 CFR 53.4
DoD contracts Subcontractor handling covered defense information Subcontractor to DoD: 72 hours Report number to prime: as soon as practicable The clause flows down “without alteration” (252.204-7012(m)(1)) DFARS 252.204-7012(m)
CMMC External Service Provider: handles CUI or Security Protection Data such as log or configuration data No separate notice clock Client’s CMMC assessment A non-cloud provider’s services sit in the client’s assessment scope and are assessed with it; a cloud provider handling CUI must meet the FedRAMP requirements in DFARS 252.204-7012 32 CFR 170.4; 170.19
FTC Safeguards Rule Service provider No separate notice clock Client to FTC: 30 days at 500+ The client must bind the provider by contract and assess it periodically (314.4(f)); an MSP may serve as Qualified Individual, but the client keeps responsibility (314.4(a)) 16 CFR 314.4
The vendor’s clock runs first, then the next noticeVendor or MSP clockWhat followsHIPAABusiness associate to covered entity: 60 daysCovered entity to individuals: 60 daysGDPRProcessor to controller: without undue delayController to authority: 72 hoursFloridaThird-party agent to covered entity: 10 daysCovered entity to individuals: 30 daysWashingtonVendor to data owner: immediatelyOwner to residents: 30 daysCaliforniaVendor to data owner: immediatelyOwner to residents: 30 daysTexasVendor to data owner: immediatelyOwner to residents: 60 daysBanksService provider to bank: as soon as possibleBank to regulator: 36 hoursDoD contractsSubcontractor to DoD: 72 hoursReport number to prime: as soon as practicable
The vendor’s clock runs first, then the next notice: a vendor or MSP clock (immediately in WA, CA and TX, 10 days in Florida, 60 days under HIPAA) and what follows. Sources: 45 CFR 164.410, GDPR Art. 33, Fla. Stat. 501.171(6), RCW 19.255.010, Cal. Civ. Code 1798.82, Tex. Bus. & Com. Code 521.053, 12 CFR 53.4, DFARS 252.204-7012; accessed October 2026.

Vendor incidents are common in practice: in our healthcare data breach report, 35% of the 802 large healthcare breaches reported in 2025 involved a business associate. IT compliance work that lands on the MSP starts with five terms in every agreement that touches regulated data:

  1. A notice window shorter than the shortest client clock: 10 days for Florida third-party agents and “immediately” in Washington, California, Texas and Maine.
  2. The notice content the client must pass on: affected individuals (45 CFR 164.410(c)(1)) and, for FTC-covered clients, the six items in 16 CFR 314.4(j)(1).
  3. Named contacts on both sides; 12 CFR 53.4(a) sends a bank service provider’s notice to the bank-designated contact, or to the CEO and CIO if none was given.
  4. Audit and assistance rights: GDPR Art. 28(3)(f) and (h), and PCI DSS 12.8.2 written agreements with service providers.
  5. For defense clients, whether the MSP stores CUI or security logs and configuration data, since that puts its services in the client’s CMMC scope (32 CFR 170.19), plus the DoD incident report number for the prime.

Worked example: one breach, three clocks

A hypothetical mortgage broker shows how one incident starts several data security compliance clocks at once. The broker holds customer information on 4,200 consumers and discovers on Monday, March 2, 2026 that an unencrypted file share was copied. The stolen files cover 1,150 consumers: 620 in Washington, 210 in California and 320 elsewhere.

Step Input Rule applied Result Deadline
FTC notice 1,150 consumers affected, at least 500 16 CFR 314.4(j) Required April 1, 2026 (discovery plus 30 days)
Washington consumer notice 620 Washington residents, data not secured RCW 19.255.010(8) Required if consumers face a risk of harm (19.255.010(1)) April 1, 2026
Washington Attorney General notice 620 is more than 500 RCW 19.255.010(7) Required April 1, 2026
California consumer notice 210 California residents, data unencrypted Cal. Civ. Code 1798.82(a)(2)(A) Required April 1, 2026
California Attorney General copy 210 is not more than 500 Cal. Civ. Code 1798.82(f) Not required None
Small-firm exemption 4,200 consumers held, fewer than 5,000 16 CFR 314.6 Exempt from 314.4(b)(1), (d)(2), (h), (i) None
Encryption duty File share unencrypted 16 CFR 314.4(c)(3) Not exempt; the share should have been encrypted None
Other residents 320 consumers in other states The state table above (tbl-states) Notice by each home state’s clock April 1, 2026 in 30-day states, April 16, 2026 in 45-day states, May 1, 2026 in 60-day states

The order of work for the broker:

  1. Day 0, March 2, 2026: record the discovery date, the first day any employee, officer or agent knew (314.4(j)(2)).
  2. By April 1, 2026: file the FTC online form with the six items in 314.4(j)(1), including the 1,150 consumers affected and whether law enforcement asked for a delay.
  3. By April 1, 2026: mail the 620 Washington and 210 California consumer notices, and send the Washington Attorney General the count and data types involved.
  4. In the same window: check the 320 remaining consumers against the breach law of each state where they live.
  5. Then: encrypt customer information at rest and in transit under 314.4(c)(3), or record compensating controls approved by the Qualified Individual.

Had the share been encrypted and the key not taken, no notice would have been due: the FTC rule, RCW 19.255.010 and Civil Code 1798.82 reach only unencrypted data or data whose key was also taken.

The same discovery would expire other clocks on these dates if the incident had involved other data, assuming discovery and the determination of a breach fall at the same moment, 9:00 on Monday, March 2, 2026:

Clock Runs out (Discovery at 9:00 on Monday, March 2, 2026) Applies to Source
36 hours March 3, 2026, 21:00 Bank to regulator (clock starts at determination) 12 CFR 53.3
72 hours March 5, 2026 GDPR authority; DoD DFARS 252.204-7012; GDPR Art. 33(1)
10 days March 12, 2026 Florida agent to entity Fla. Stat. 501.171(6)
30 days April 1, 2026 FTC, WA, CA, FL, ME 16 CFR 314.4(j); state table
45 days April 16, 2026 AZ, MD, VT 9 V.S.A. 2435; state table
60 days May 1, 2026 HIPAA, TX, CT, DE, LA 45 CFR 164.404; state table
One discovery at 9:00 on Monday, March 2, 2026: when each clock runs outDiscovery36 hoursMarch 3, 2026, 21:00Bank to regulator72 hoursMarch 5, 2026GDPR authority; DoD10 daysMarch 12, 2026Florida agent to entity30 daysApril 1, 2026FTC, WA, CA, FL, ME45 daysApril 16, 2026AZ, MD, VT60 daysMay 1, 2026HIPAA, TX, CT, DE, LA
One discovery at 9:00 on Monday, March 2, 2026: when each clock runs out, from March 3, 2026, 21:00 (36 hours) to May 1, 2026 (60 days), assuming discovery and determination coincide. Sources: eCFR, GDPR, DFARS and the state statutes in tbl-states; accessed October 2026.

What do most data security compliance guides get wrong?

Five claims repeat across data security compliance guides and miss the primary text. The two with the biggest effect: breaches of GDPR’s security and notice articles sit in the €10 million or 2% tier unless the Art. 5(1)(f) security principle is also breached, and California now sets a 30-day deadline, with delay allowed only for law enforcement or to scope the breach.

Common claim What the primary source says Source
GDPR fines for data security failures reach €20 million or 4% of turnover Articles 32 to 34 fall under Art. 83(4)(a), “Articles 8, 11, 25 to 39,” capped at €10,000,000 or 2% of worldwide annual turnover, whichever is higher. The €20 million or 4% tier in Art. 83(5) covers principles, consent and data subject rights, including the Art. 5(1)(f) security principle, so it applies only when a regulator also finds that principle breached. GDPR Art. 83; Art. 5; EDPB Guidelines 04/2022
HIPAA requires encryption 45 CFR 164.312(a)(2)(iv) and (e)(2)(ii) still label encryption “Addressable”; the January 6, 2025 proposal to change that was not final in October 2026. eCFR; Federal Register
Defense contractors should build to NIST SP 800-171 Rev. 3 CMMC Level 2 is identical to Rev. 2’s 110 requirements, and DoD’s September 2026 class deviation requires Rev 2 as the baseline and implements a July 13, 2026 DoD CIO memo that suspends the November 2026 CMMC Phase 2 transition. 32 CFR 170.14; DoD class deviation 2026-O0025
California has no fixed breach deadline, only “the most expedient time possible” SB 446 amended Civil Code 1798.82: disclosure “shall be made within 30 calendar days of discovery or notification,” effective January 1, 2026; delay is allowed only for law enforcement or to determine the scope of the breach and restore the system (1798.82(a)(2)(B)). Cal. Civ. Code 1798.82
PCI non-compliance costs up to $100,000 a month The PCI SSC standards page names no fine amount and leaves compliance programs to payment brands and acquirers, so any penalty sits in your acquirer contract. PCI SSC

What are the most common mistakes, and what do they cost?

The costliest mistakes are procedural: starting the breach clock late, skipping the paperwork behind an addressable control, and leaving vendors out of contracts. The consequences below are the amounts and outcomes the rules themselves state, such as HIPAA penalties of up to $73,011 per violation and $2,190,294 per calendar year for identical violations (45 CFR 102.3, 2025 adjustment).

Mistake Rule Consequence stated in the rule Source
Starting the clock when forensics finish 45 CFR 164.404(a)(2); 16 CFR 314.4(j)(2) Discovery is the first day anyone in the workforce or any agent knew, or under HIPAA should have known; notice after day 60 (HIPAA) or day 30 (FTC) is late eCFR 164.404
Treating “addressable” as optional 45 CFR 164.306(d)(3) You must document why a specification is unreasonable and adopt an equivalent; lost unencrypted ePHI is “unsecured” and triggers notice eCFR 164.306
Assuming the small-firm exemption covers everything 16 CFR 314.6 Only four elements are waived; encryption, MFA and the 30-day FTC notice still apply eCFR 314.6
Self-assessing CMMC Level 2 below 88 of 110 32 CFR 170.21(a)(2)(i) No Conditional status; open POA&M items must close within 180 days or the status expires eCFR 170.21
Leaving vendors out of the plan 45 CFR 164.410; GDPR Art. 33(2); RCW 19.255.010(2); PCI DSS 12.8.2 Business associates have 60 days, processors “without undue delay,” Washington vendors “immediately”; PCI needs written agreements eCFR 164.410
Keeping card security codes after authorization PCI DSS 3.3.1 Not allowed “even if encrypted” PCI SSC SAQ D
No reasonable security for Californians’ data Cal. Civ. Code 1798.81.5; 1798.150 Consumers may sue for $107 to $799 per consumer per incident (CPI-adjusted from $100 to $750 on January 1, 2025), or actual damages if greater Cal. Civ. Code 1798.150; CPPA

Actual HIPAA resolutions sit far below the regulatory ceilings of $73,011 per violation and $2,190,294 a year. Our HIPAA enforcement tracker found a median verified settlement or penalty of $240,000 for 2024 to 2026, down from $1,600,000 for 2016 to 2019, across a record 25 OCR actions in 2025.

Which data security compliance rule should you work on first?

Work first on the rule with the shortest clock and the firmest control. If you hold defense CUI or EU personal data, a 72-hour reporting duty means incident response comes before anything else. If you are a non-bank financial firm, the FTC’s mandatory encryption and MFA are the gaps most likely to turn an incident into a 30-day notice. The decision table sets the order.

Answer in order: “Yes” names the first rule to work on, and “No, or also” moves to the next question.

Question If yes, do this first Detail and thresholds Source
Are you a health provider or plan, or do you handle their ePHI? HIPAA: risk analysis, 164.312 controls, 60-day breach clock 164.308(a)(1)(ii)(A) risk analysis, a decision on each addressable item, business associate agreements; 500+ adds HHS and media notice 45 CFR 164.308
Do you store, process or transmit card numbers? PCI DSS v4.0.1: confirm SAQ or ROC with your acquirer SAQ: Self-Assessment Questionnaire; ROC: Report on Compliance; scans every three months PCI SSC SAQ D
Are you a non-bank financial firm under the FTC? Safeguards Rule: encrypt, MFA, FTC notice at 500+ in 30 days Name a Qualified Individual under 314.4(a) 16 CFR 314.4
Do you hold CUI under a DoD contract? NIST SP 800-171 Rev. 2, SPRS score, 72-hour DoD report Post the self-assessment score to SPRS (Supplier Performance Risk System); 88 of 110 minimum for Conditional status 32 CFR 170.16
Do you process personal data of people in the EU? GDPR Art. 32 controls, 72-hour notice, processor terms Processor terms under Art. 28 GDPR
Are you an SEC registrant? Item 1.05 Form 8-K within 4 business days of materiality Name who decides materiality and how fast SEC
Every case: the breach law of each affected person’s state (30 days in CA, WA and FL) Record the home state of each affected person Other states set their own clocks RCW 19.255.010
Are you a health provider or plan, or do you handle their ePHI?YesHIPAA: risk analysis, 164.312 controls, 60-day breach clockNo, or alsoDo you store, process or transmit card numbers?YesPCI DSS v4.0.1: confirm SAQ or ROC with your acquirerNo, or alsoAre you a non-bank financial firm under the FTC?YesSafeguards Rule: encrypt, MFA, FTC notice at 500+ in 30 daysNo, or alsoDo you hold CUI under a DoD contract?YesNIST SP 800-171 Rev. 2, SPRS score, 72-hour DoD reportNo, or alsoDo you process personal data of people in the EU?YesGDPR Art. 32 controls, 72-hour notice, processor termsNo, or alsoAre you an SEC registrant?YesItem 1.05 Form 8-K within 4 business days of materialityNo, or alsoEvery case: the breach law of each affected person’s state (30 days in CA, WA and FL)
Answer Yes or No, or also, at each step: six questions route an organisation to its first rule, and every path ends at state breach law, which sets 30 days in California, Washington and Florida. Sources: eCFR, PCI SSC, GDPR, SEC, state statutes; accessed October 2026.

How we compiled this

We compiled this page from 37 regulation and statute texts (24 eCFR sections, the GDPR and 12 sections of state law across 11 states), 17 publications from PCI SSC, CPPA, NIST, ISO, the SEC, FTC, Federal Register, EDPB, Department of Education and DoD, and six Uptime Report research datasets, all accessed in October 2026. We did not test products or survey companies. We excluded vendor blog figures, card-brand fine estimates and state statutes we could not read at the official source, such as Colorado and Ohio. This page is not legal advice.

Frequently asked questions

How do you ensure data security and compliance?

List the data types you hold, map each to its rule, then close the control gaps in order of the shortest reporting clock. In practice that means a written risk assessment, encryption at rest and in transit, multi-factor authentication, audit logs, scheduled vulnerability scans and a tested incident response plan, which 16 CFR 314.4 and PCI DSS v4.0.1 both require.

Why do organisations follow data security compliance standards?

Because the law or their contracts require it. HIPAA penalties reach $73,011 per violation and $2,190,294 a year for identical violations (45 CFR 102.3), breaches of GDPR Articles 32 to 34 can be fined up to €10 million or 2% of worldwide turnover, whichever is higher (more if the Art. 5(1)(f) security principle is also breached), and card acceptance depends on meeting PCI DSS as set by payment brands and acquirers.

Is there a data security compliance certification?

No single certificate covers every rule. PCI DSS is validated through a Self-Assessment Questionnaire or a Report on Compliance; CMMC Level 2 uses a self-assessment or a C3PAO certification assessment under 32 CFR 170.16 and 170.17; ISO/IEC 27001:2022 sets management-system requirements that third-party bodies certify against. GDPR Article 42 certification is voluntary and “does not reduce the responsibility” of the controller or processor.

Does GDPR apply to US companies?

Yes, when a US company offers goods or services to people in the EU or monitors their behaviour there, under GDPR Article 3(2) (Regulation 2016/679). It must then apply Article 32 security measures, notify the competent supervisory authority within 72 hours of becoming aware of a breach, and bind its processors by contract under Article 28. GDPR sets no company-size threshold for these duties.

Does the FTC Safeguards Rule apply to my business?

It does if you are a non-bank business significantly engaged in a financial activity. The examples in 16 CFR 314.2 include tax preparers, mortgage brokers, real estate settlement firms, property appraisers, check cashers, credit counselors and car dealers that lease vehicles for more than 90 days. Holding data on fewer than 5,000 consumers waives only four elements, not encryption, MFA or the FTC notice.

Can our MSP be the Qualified Individual under the Safeguards Rule?

Yes. 16 CFR 314.4(a) lets the Qualified Individual be employed by a service provider, but the client then keeps responsibility for compliance, must name a senior staff member to direct and oversee that person, and must require the provider to run a security program that protects the client. The Qualified Individual reports in writing to the board at least once a year under 314.4(i), unless the firm holds data on fewer than 5,000 consumers (314.6).

Is an MSP in scope for a client’s CMMC assessment?

An MSP counts as an External Service Provider when CUI or Security Protection Data, such as log and configuration data, sits on its assets (32 CFR 170.4). Under the scoping tables in 32 CFR 170.19, a non-cloud provider’s services are then in the client’s assessment scope and are assessed with it. A provider that handles neither “does not meet the CMMC definition of an ESP.”

Sources

  1. eCFR, 45 CFR 164.312 Technical safeguards (HIPAA Security Rule). Accessed October 2026.
  2. eCFR, 45 CFR 164.306 Security standards: general rules (addressable specifications). Accessed October 2026.
  3. eCFR, 45 CFR 164.308 Administrative safeguards. Accessed October 2026.
  4. eCFR, 45 CFR 164.402 Definitions (unsecured protected health information). Accessed October 2026.
  5. eCFR, 45 CFR 164.404 Notification to individuals. Accessed October 2026.
  6. eCFR, 45 CFR 164.406 Notification to the media. Accessed October 2026.
  7. eCFR, 45 CFR 164.408 Notification to the Secretary. Accessed October 2026.
  8. eCFR, 45 CFR 164.410 Notification by a business associate. Accessed October 2026.
  9. eCFR, 45 CFR 160.404 Amount of a civil money penalty. Accessed October 2026.
  10. eCFR, 45 CFR 102.3 Penalty adjustment and table (2025 adjustment). Accessed October 2026.
  11. eCFR, 16 CFR 314.2 Definitions (FTC Safeguards Rule). Accessed October 2026.
  12. eCFR, 16 CFR 314.4 Elements (FTC Safeguards Rule). Accessed October 2026.
  13. eCFR, 16 CFR 314.6 Exceptions. Accessed October 2026.
  14. eCFR, 34 CFR 99.1 Applicability (FERPA). Accessed October 2026.
  15. eCFR, 34 CFR 99.31 Disclosure without prior consent (FERPA). Accessed October 2026.
  16. eCFR, 32 CFR 170.14 CMMC Model. Accessed October 2026.
  17. eCFR, 32 CFR 170.16 CMMC Level 2 self-assessment. Accessed October 2026.
  18. eCFR, 32 CFR 170.21 Plan of Action and Milestones requirements. Accessed October 2026.
  19. eCFR, 32 CFR 170.4 Acronyms and definitions (External Service Provider). Accessed October 2026.
  20. eCFR, 32 CFR 170.19 CMMC scoping (ESP scoping tables). Accessed October 2026.
  21. eCFR, 48 CFR 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. Accessed October 2026.
  22. eCFR, 12 CFR 53.3 Notification (OCC computer-security incident rule). Accessed October 2026.
  23. eCFR, 12 CFR 53.4 Bank service provider notification. Accessed October 2026.
  24. eCFR, 17 CFR 229.106 (Regulation S-K Item 106) Cybersecurity. Accessed October 2026.
  25. EUR-Lex, Regulation (EU) 2016/679 (GDPR). Accessed October 2026.
  26. legislation.gov.uk, Regulation (EU) 2016/679 Article 5, as adopted. Accessed October 2026.
  27. legislation.gov.uk, Regulation (EU) 2016/679 Article 28, as adopted. Accessed October 2026.
  28. legislation.gov.uk, Regulation (EU) 2016/679 Article 83, as adopted. Accessed October 2026.
  29. legislation.gov.uk, Regulation (EU) 2016/679 Article 42, as adopted. Accessed October 2026.
  30. EDPB, Guidelines 9/2022 on personal data breach notification under GDPR, v2.0 (28 March 2023). Accessed October 2026.
  31. EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR. Accessed October 2026.
  32. SEC, press release 2023-139: SEC adopts rules on cybersecurity risk management and incident disclosure. Accessed October 2026.
  33. FTC, press release: FTC amends Safeguards Rule to require non-banking financial institutions to report data security breaches (October 27, 2023). Accessed October 2026.
  34. Federal Register, Standards for Safeguarding Customer Information, 88 FR 77499 (November 13, 2023). Accessed October 2026.
  35. Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule (January 6, 2025). Accessed October 2026.
  36. PCI SSC, Just Published: PCI DSS v4.0.1 (June 11, 2024). Accessed October 2026.
  37. PCI SSC, PCI DSS v4.0 Self-Assessment Questionnaire D for Merchants (April 2022; requirement numbering unchanged in v4.0.1, no public v4.0.1 SAQ D URL resolved). Accessed October 2026.
  38. PCI SSC, PCI DSS standard overview page. Accessed October 2026.
  39. NIST, SP 800-171 Rev. 3 (May 2024). Accessed October 2026.
  40. NIST, SP 800-171 Rev. 2. Accessed October 2026.
  41. NIST, Cybersecurity Framework 2.0, CSWP 29 (February 26, 2024). Accessed October 2026.
  42. ISO, ISO/IEC 27001:2022 Information security management systems. Accessed October 2026.
  43. Washington State Legislature, RCW 19.255.010. Accessed October 2026.
  44. California Legislature, Civil Code 1798.82 (as amended by SB 446, Stats. 2025, Ch. 319). Accessed October 2026.
  45. California Legislature, Civil Code 1798.81.5. Accessed October 2026.
  46. California Legislature, Civil Code 1798.150. Accessed October 2026.
  47. Florida Legislature, Florida Statutes 501.171. Accessed October 2026.
  48. California Privacy Protection Agency, CPI adjustment of monetary thresholds (effective January 1, 2025). Accessed October 2026.
  49. Texas Legislature, Business and Commerce Code 521.053. Accessed October 2026.
  50. Connecticut General Assembly, Conn. Gen. Stat. 36a-701b. Accessed October 2026.
  51. Delaware Code, 6 Del. C. 12B-102. Accessed October 2026.
  52. Louisiana Legislature, La. R.S. 51:3074. Accessed October 2026.
  53. Vermont Legislature, 9 V.S.A. 2435. Accessed October 2026.
  54. Arizona Legislature, A.R.S. 18-552. Accessed October 2026.
  55. Maryland General Assembly, Md. Code, Commercial Law 14-3504. Accessed October 2026.
  56. Maine Legislature, 10 M.R.S. 1348. Accessed October 2026.
  57. DoD, Class Deviation 2026-O0025, Revision 3 (signed September 3, 2026). Accessed October 2026.
  58. US Department of Education, Student Privacy Policy Office, A Parent’s Guide for Understanding K-12 School Data Breaches (SPPO-21-03). Accessed October 2026.
  59. The Uptime Report, Healthcare Data Breach Report 2026. Accessed October 2026.
  60. The Uptime Report, How Long Do Companies Take to Report a Data Breach?. Accessed October 2026.
  61. The Uptime Report, SEC Cybersecurity Incident Disclosures: Every Form 8-K Item 1.05 Filing. Accessed October 2026.
  62. The Uptime Report, Item 1C Cybersecurity Disclosures. Accessed October 2026.
  63. The Uptime Report, HIPAA Enforcement Tracker. Accessed October 2026.
  64. The Uptime Report, CMMC Certification by the Numbers. Accessed October 2026.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts