Which law requires notification to affected individuals if a database breach occurs?

Which law requires notification to affected individuals if a database breach occurs?

• A. California Security Breach Information Act
• B. California Data Breach Notification Act
• C. Information Security Disclosure Act
• D. Data Privacy Breach Act

Answer: (A)

The main idea here is that California mandates action when personal information is exposed in a breach. The law that requires notifying affected individuals is the California Security Breach Information Act. It says that if a breach compromises personal data, the entity must inform those whose information was exposed, describing what happened, what information was involved, and steps they can take to protect themselves. The notice should go out in a timely manner, and there are additional requirements—such as notifying the California Attorney General if a large number of residents are affected, and using substitute notice if direct notification isn’t feasible. Data that’s encrypted may change the notification obligation, but when unencrypted personal information is involved, notification is typically required. While you may see the term California Data Breach Notification Act used in practice, the standard reference for the notification requirement in California is the Security Breach Information Act.

The main idea here is that California mandates action when personal information is exposed in a breach. The law that requires notifying affected individuals is the California Security Breach Information Act. It says that if a breach compromises personal data, the entity must inform those whose information was exposed, describing what happened, what information was involved, and steps they can take to protect themselves. The notice should go out in a timely manner, and there are additional requirements—such as notifying the California Attorney General if a large number of residents are affected, and using substitute notice if direct notification isn’t feasible. Data that’s encrypted may change the notification obligation, but when unencrypted personal information is involved, notification is typically required. While you may see the term California Data Breach Notification Act used in practice, the standard reference for the notification requirement in California is the Security Breach Information Act.