Why state rules matter
States have their own breach notification laws. These laws generally define what counts as personal information, when an organization must notify affected people, and when a regulator may need to receive notice. The exact timing and requirements depend on the facts of the incident.
What to do with your letter
Regardless of where you live, preserve the notice, check the data categories involved, protect important accounts, and calendar any deadlines for complimentary monitoring. If you want to verify the incident, look for an official announcement from the organization or your state attorney general’s office.
General information, not legal advice
This page is an educational starting point rather than a statement of current state law. An attorney can help you understand how the facts of a particular breach and the rules in your state may apply to you.