Extract to table

While these statutes vary in their specific language, definitions, and procedural requirements, they share a common analytical framework consisting of three principal elements that must be satisfied to trigger the notification obligation: 1

Timing Requirement: Notice to affected individuals must be provided no later than sixty (60) days after the discovery of the breach

Notice to the Connecticut Attorney General must be provided no later than the time at which individual notices are distributed and must include certain additional information, including the number of Connecticut residents affected

Notification to the Connecticut Attorney General is required and must be submitted no later than the date individual notification letters are mailed

Quorum must notify the New York Attorney General, the Secretary of State, and the Division of State Police

These notifications must be made simultaneously with, or prior to, consumer notification