Breach reporting to all consumer reporting agencies that compile and maintain files on a nationwide basis is required if more than 1,000 persons are affected by a breach of security, without unreasonable delay. The Organization will be responsible to complete any required regulatory reporting and consumer notification.

There is specifically defined information that must be included in the consumer notification. If any state residents are affected by a breach of security, the breached Organization must give notice without delay to each individual affected by the breach.

The Attorney General may bring an action to enforce repeated and willful violations of the breach requirements, with civil penalties assessed up to $150,000. Violations of the breach notification requirements constitute an unfair or deceptive act or practice.

There are industry-specific laws governing the protection of personal data for health, insurance, and education.

Vendors must notify Organizations as soon as possible after the discovery of a breach or suspected breach.