Incident Response Practice Tip: Balance Meeting Breach Notification Deadlines With Securing Your Network

State breach notification statutes are being amended on almost a monthly basis. Several laws have, or will soon have, a mandatory notification deadline for notifying affected individuals after the discovery of the incident. Washington's new law, which went into effect on July 24, includes a 45-day deadline for notification but goes further to allow for extra time "to determine the scope of the breach and restore reasonable integrity of the data system." This is an excellent approach to a difficult issue. Many legislators believe that the "law enforcement delay" provisions in most breach notification statutes is sufficient to allow a company to delay notification when appropriate; however, the reality is that law enforcement is reluctant in the vast majority of incidents to state in writing that public notice of the incident would impede their investigation.