A 14-person e-commerce shop using Shopify and QuickBooks discovers that a misconfigured inbox rule forwarded order confirmations — with names, addresses, and the last four of payment cards plus expiration — to an external address for 11 days. About 620 customer records across 9 states are involved, 140 of them in California. The owner assumes breach-notification laws are for hospitals and Fortune 500s, that encrypting the sheet counts as safe harbor, and that "we'll notify within 60 days" is reasonable everywhere. In 2026, none of those assumptions survives contact with the state statutes — and California's SB 446 just shortened the clock that matters most.
All 50 states, D.C., and the territories have data breach notification laws. Company size does not exempt you. If you own, license, or maintain computerized data that includes personal information about a resident of a state, that state's law follows the resident — not your headquarters. For a small business that sells online, takes appointments, or keeps a customer list with emails and passwords, that means one incident can trigger 9 different timelines, thresholds, and attorney-general notices.
This playbook is informational, not legal advice — Foley & Lardner's March 2026 chart and the underlying statutes update frequently and in different directions, so a one-size-fits-all notice will not suffice. But the structure below is the one a small business can actually operate: what triggers notice, when the clock starts, California's 2026 change, AG triggers, the risk-of-harm question, breach logs, and the shortest-deadline rule that should govern a multi-state response.
Why Small Businesses Are In Scope — And Why That Matters to the Ledger
Every state defines a covered entity broadly — typically any person or business that owns, licenses, or maintains computerized personal information — with no small-business exemption. A few states add narrow carve-outs for entities already regulated under HIPAA or the Gramm-Leach-Bliley Act, and a few excuse good-faith acquisition by an employee for a legitimate purpose, but there is no "under 50 employees" or "under $5M revenue" off-ramp.
Personal information generally means first name or initial + last name combined with one or more of: Social Security number, driver's license or state ID number, financial account or payment-card number with security code/access code/password that would permit access, and increasingly — biometric data, health information, and username/email + password/security question. Encrypted data is often exempt from the definition only if the encryption key was not also acquired and the encryption meets a recognized standard — "we password-protected the spreadsheet" is not that.
Two practical consequences for bookkeeping:
- Your customer, employee, and vendor files are the regulated data set — the same files that feed invoicing, payroll, and loyalty. If payroll includes SSNs or health-plan data, the breach surface is not just the storefront.
- The cost of responding — forensics, counsel, notice, credit monitoring, AG filings, and potential fines — lands as a period expense, often in a different quarter than the breach itself. Budget for it as a contingent liability, not as an afterthought.
The Anatomy of a State Law — The Six Pieces Every Notice Must Satisfy
While details vary, every statute answers the same six questions. Map the incident to each before you draft a word.
- Who is covered — Owner/licensee of the data vs. mere maintainer/processor. Processors typically must notify the owner without unreasonable delay; owners owe notice to residents. Know which you are for each data set — Shopify may be the processor for the storefront, you are the owner of the export.
- What counts as personal information — The combinations that trigger the statute, plus the encryption and public-record exceptions. If the only element exposed was names and addresses without a second factor, some states are not triggered; others are if the combination plus the context permits identity theft.
- What counts as a breach — Unauthorized acquisition in most states; unauthorized access plus acquisition in a few. The standard matters for a mis-sent email vs. a mailbox that was merely exposed.
- When the clock starts — Almost universally upon discovery or notification of the breach by the person or business, not when the intrusion began. Document the discovery date and time — regulators will ask.
- Who must be notified, how, and with what content — Residents, and in many states the attorney general and/or consumer reporting agencies above a resident-count threshold. Methods include written, electronic (if consistent with E-SIGN), and substitute notice (website + statewide media + major consumer reporting agencies) when direct notice cost exceeds a threshold or affected count exceeds 100,000–500,000. Content typically includes what happened, types of information, what you're doing, and contact information.
- How long you must keep the record — Breach logs and determinations (whether to notify, risk-of-harm analysis, AG filings) must be retained, typically 3–5 years. This is the piece most small businesses discard — and the one examiners ask for first.
Timelines in 2026 — The Clock Is Shorter Than You Think
States phrase deadlines three ways: a fixed number of days, "without unreasonable delay" or "in the most expedient time and without unreasonable delay," or both — a reasonableness standard capped by a hard outer bound. The trend through 2025–2026 has been toward explicit caps of 30–60 days, with enforcement leaning shorter.
Common buckets as of March 2026 (verify each state's current text — these move):
- 30 days — The strictest tier, now including California for most personal-information breaches (see SB 446 below), plus a handful of other states that have adopted 30- or 45-day caps in the last two legislative cycles. Colorado, Florida, and Ohio have been in the 30-day group for several cycles.
- 45 days — A growing middle tier.
- 60 days — The most common outer bound (e.g., many states phrase it as "without unreasonable delay and in no case later than 60 days").
- "Without unreasonable delay" with no numeric cap — Still present in a minority of states, but regulators enforce it as if a cap existed — waiting 70 days with no forensic justification is not treated as reasonable anywhere.
The shortest-deadline rule for multi-state operators: If you have residents of California (30 days) and Texas (60 days) in the same incident, the California deadline governs the whole response unless you tranche notices by state — which is slower and more expensive than sending once on the shortest clock. Plan the investigation and notification workback from the shortest applicable deadline the day you document discovery.
California SB 446 — The 2026 Change That Moves the Needle
California's breach-notification statute (Civil Code §§ 1798.80–1798.84) already had outsized influence because so many businesses touch California residents. SB 446, the breach-notification update moving through the 2025–26 session, tightens it in two ways small businesses must calendar:
- 30-day resident notice deadline. The bill narrows the prior "most expedient time and without unreasonable delay" flexibility to a hard 30-day outer bound from discovery for notices to affected California residents in most personal-information breaches — aligning California with the strictest tier rather than as a reasonableness standard. Day 1 is the date you knew or reasonably should have known, including notice from a vendor/processor. Weekends count. Extensions for law-enforcement delay remain narrow and must be documented in writing from the agency.
- 15-day Attorney General notice for larger breaches. When more than 500 California residents are affected (the bill text has refined this count through amendments — the AG-notice tier is typically 500 in California; verify the chaptered version), the business must notify the California Attorney General within 15 days of the resident notice, and many read SB 446 as requiring AG notice no later than 15 days after discovery when the count is clearly above threshold — effectively a parallel 15-day track. The filing is electronic through the AG's breach portal and triggers public posting. Missing the AG notice is a separate violation even if residents were timely notified.
Operational meaning: a 140-California-resident breach described in the opening is below the AG-notice count, but the 30-day resident clock still governs. A 620-resident multi-state breach with 140 in California still sends one notice on the 30-day clock — the California deadline pulls the whole incident forward.
Attorney General and Consumer Reporting Agency Triggers — The 500 / 1,000 Thresholds
Beyond California, the most common AG-notice thresholds cluster at 500 and 1,000 residents in the state, with timing that is often contemporaneous with or within a few days of resident notice. A selection as generally understood in early 2026:
- ~500 residents — AG or designated state agency notice in California (500), Indiana, and several others; often due within days of resident notice.
- ~1,000 residents — AG notice in New York, North Carolina, and others; New York also requires notice to consumer reporting agencies at the same tier.
- Credit-monitoring agency notice — Typically when 1,000+ residents are notified, businesses must also notify the major consumer reporting agencies (Equifax, Experian, TransUnion) of the timing and scope, without including personal data.
Keep a threshold matrix — state × AG threshold × AG deadline × CRA threshold — in your incident-response plan. The pattern to internalize: once you cross 500 in any one state, assume an AG filing; once you cross 1,000 in any one state, assume AG + CRA.
The Risk-of-Harm Exemption — Narrower Than It Sounds
About half the states include a risk-of-harm (or likelihood-of-harm / no reasonable likelihood of harm) analysis that can excuse notification if, after a reasonable investigation, you determine there is no reasonable likelihood of identity theft, fraud, or other harm. The analysis is not a gut feeling. States that permit it typically require:
- A documented, fact-specific determination — what data, how acquired, whether the recipient is known and trusted, whether the data was actually accessed or only exposed, and mitigation (retrieval, deletion confirmation).
- Retention of that determination for 3–5 years (see below) — a regulator will ask to see it.
- That you still notify the AG or state agency in some states even when you forgo resident notice, or that you notify if harm later becomes reasonably possible.
Trend: states have been narrowing the exemption by presuming harm for SSNs and by tightening what counts as a reasonable determination. Treat it as an exception to be documented by counsel, not as the default path.
Breach-Log Retention — The Control Most Small Businesses Skip
Statutes and regulations increasingly require you to maintain a breach log or file that includes the discovery date, scope, types of personal information, number of residents per state, risk-of-harm determination, notice dates and samples, AG and CRA filings, and law-enforcement delay documentation if any. Retention is typically 3 years, with a clear drift toward 5 years in updated statutes and in health-adjacent contexts.
Bookkeeping tie-in: store the breach file alongside — but access-controlled separately from — the financial close file. The log supports the financial statement disclosure (if material) and the tax treatment of response costs.
A Playbook You Can Actually Run — From Discovery to Filing
Day 0–1 — Contain and clock:
- Stop the exposure, preserve evidence, and document the discovery date/time and reporter. Start the shortest-deadline workback that day. Engage counsel under privilege before forensics if feasible.
Day 1–3 — Scope by resident, not by record:
- Inventory what personal-information combinations were actually acquired, by state of residence — not just total records. A 620-record incident can be 140 California + 85 Texas + 320 single-state. Each count maps to a different deadline and threshold. Confirm encryption safe-harbor applicability with the actual key status.
Day 3–7 — Draft the notice package once, on the shortest deadline:
- Resident notice (what happened, data types, what you're doing, contact, and — where required — steps to protect, plus any state-specific language). Plan substitute notice now if direct-notice cost or count will exceed the statutory threshold — don't discover that on day 28.
- AG notices and portal filings for every state above threshold, and CRA notices where required.
- Credit-monitoring or identity-protection offer decisions — required in a subset of states/sectors above a threshold, market-expected elsewhere. Budget per-resident cost now; log the decision.
Day 7–15 — File and mail on the shortest clock:
- For a California-touching incident under SB 446, resident notice within 30 days is the outer bound — but AG-notice states at 500+ may effectively require AG filing within ~15 days of discovery/resident notice. Build the calendar as the earlier of the two. Law-enforcement delay requires written agency direction — verbal does not toll the clock.
Day 15–60 — Close the loop:
- Handle undeliverable notices, post substitute notice where required, reconcile notice counts to the resident matrix, and file the breach log with retention clock. Update the financials: accrue response costs incurred but not yet invoiced, and — if the breach involved payment-card data — reconcile processor, gateway, and bank deposits for any fraudulent-charge exposure.
Quarterly thereafter — Keep the log alive:
- Retain the full breach file 5 years unless a longer sector requirement applies. Calendar the destruction date, not just the creation date.
The Small-Business Controls That Make This survivable
- Minimize the data you keep. If you don't need SSNs, don't collect them. If you don't need full card numbers, don't store them — tokenize. Retention policy is a breach-scope control.
- Map where personal information lives. POS, e-commerce platform, email, file shares, payroll/HR, and that shared drive with last year's W-2 PDFs — inventory them before an incident does.
- Vendor and processor terms. Your contract with the e-commerce platform, email provider, and payroll service should require prompt breach notification to you (e.g., within 24–48 hours) and specify who notifies residents. The discovery clock can start when your processor knew — contract language that delays their notice to you does not delay the state's clock for you.
- Tabletop once. A 90-minute walkthrough of this playbook with the owner, the person who manages the store/email, and your CPA or counsel is worth more than a binder that no one has opened.
The Bookkeeping Connection
A breach is a compliance event before it is a press event — and the accounting reflects it. When the resident matrix (state × count), the discovery date, the notice and AG filing dates, the forensics and monitoring invoices, and the breach-log retention calendar live in the same version-controlled record as the close, the story from "11 days of forwarded confirmations" to "620 residents across 9 states, 140 in California, notices mailed day 18, AG filings where required, costs accrued in Q3, log retained through 2031" is traceable and explainable to a regulator, an insurer, or an auditor who asks what happened and when.
Simplify Your Financial Management
Handling sensitive customer data well is a records problem and a controls problem before it is a marketing problem. Beancount.io gives you plain-text, version-controlled accounting where customer data flows, vendor obligations, and incident costs stay explicitly linked — no black boxes, no vendor lock-in, and AI-ready when you want help turning last week's operations into a trusted financial record. Get started for free and keep the books that keep trust.