Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws

Notification: Method and Substitute Notice

The default method is written notice by postal mail. Email or phone are usually allowed only if the person previously and explicitly chose that channel. For very large breaches, substitute notice (website posting, statewide media) is permitted to avoid undue burden.

How this supports CIPP/US study

Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.

Laws generally require written notification by postal mail. Email or telephone are acceptable alternatives usually only if the affected party previously and explicitly chose that as their preferred channel.

For breaches affecting thousands or millions, individual notice could be an undue financial burden, so laws permit substitute notice - conspicuous website posting and notification to major statewide media (newspapers, radio, television).

Key terms - quick answers

What is “Substitute notice”?
An alternative method - such as conspicuous website posting or statewide media - permitted for large breaches where individual notice would impose an undue financial burden.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.