HumenhukCIPP/US Study Guide
Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws

Exceptions to Notification

Reviewed by Victor Humenhuk. Published . Reviewed .

Three exceptions excuse notice: an entity subject to a more stringent law (e.g., HIPAA or the GLBA Safeguards Rule), an entity following its own compatible policy, or data within the encryption safe harbor. The encryption safe harbor typically fails if the decryption key is breached too.

How this supports CIPP/US study

Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.

  • Entities subject to another more stringent breach law - e.g., HIPAA (Chapter 8) or financial institutions under the GLBA Safeguards Rule (Chapter 9)
  • Entities following their own notification policy, if compatible with the state law
  • Data within the safe harbor - encrypted, redacted, unreadable, or unusable
The key must stay secure

All state breach laws include an encryption safe harbor, but it typically applies only when the decryption key remains secure. Laws like Illinois make explicit that the exception does not apply when the decryption key is breached along with the encrypted data.

Key terms - quick answers

What is “Encryption safe harbor”?
A provision excusing breach notice where data was encrypted, redacted, or rendered unreadable/unusable - generally only if the decryption key was not also breached.
What is “GLBA Safeguards Rule”?
A Gramm-Leach-Bliley Act rule for financial institutions; entities compliant with it may be exempt from a state breach law under the more-stringent-law exception.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.