Three States Launch New Data Breach Notification Requirements

Companies in Texas, Illinois, and Oregon will have new notification obligations if they experience a data breach, under amendments to state laws taking effect Jan. 1.

States have been updating data breach notice statutes in recent years to broaden the definition of personal information and change requirements for when and how to notify affected individuals or the state attorney general. All 50 states and the District of Columbia require companies to notify people of security breaches of personal information.

The amendments taking effect Jan. 1 are “building on the trends we’ve been seeing,” Brian Kint, an attorney at Cozen O’Connor ...