2023 Breach Notification Law Update: Changes To Notification And Security Requirements Continue At State And Federal Levels

Overview

A flurry of legislative activity over the past year has brought meaningful changes to a variety of privacy and security provisions in state and federal law. At the state level, as in 2022, we have seen a handful of changes to generally applicable breach notification statutes, along with action on both narrower security provisions and broader omnibus privacy laws. On the federal level, the most significant development is the U.S. Security and Exchange Commission's (SEC) recent changes to reporting requirements for public companies, but rulemaking is underway in multiple other sectors as well.

For businesses and organizations subject to state and federal data breach notification obligations, understanding the magnitude of these changes—as well as when these changes take effect—will be crucial for compliance. Below is a summary of some of the major changes and amendments for the year.