Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws
Notification: Consumer Reporting Agencies
About two-thirds of states require notice to nationwide CRAs, often above a 250 to 1,000 threshold. The common timing standard is without unreasonable delay or deferring to federal statute; Minnesota's 48 hours is the shortest.
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.
- Threshold: about half attach a numeric threshold, typically 250 to 1,000 (state residents or individuals)
- Most common timing: without unreasonable delay
- Second most common: defer to federal statute timing
- Shortest timeframe: Minnesota requires reporting within 48 hours
- A minority of states set no CRA timing requirement
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.