What Is "Expedient" Notification Of A "Data Breach?"

One of the first questions companies ask us when we are hired to help them respond to a new security incident is how fast they have to notify if the investigation shows that a "breach" occurred.  Except for a couple of states that require notification to occur no later than 45 days after discovery, there is not a bright-line, objective answer.  Most state breach notification laws require notification to occur as soon as reasonably possible and without undue delay subject to some qualifications.  For example, California's law requires that: "The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement . . . or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system."  Aside from one state attorney general who uses notification within 30 days as a guidepost, there is relatively little precedent to guide companies in