Breach Deadline Calculator

None of the federal clocks starts on the day of the breach. The FTC clock starts on discovery: the first day any employee, officer or other agent, other than the person committing the breach, knows of it. The SEC Regulation S-P clocks start when the firm or its service provider becomes aware. The IRS reporting standard runs from confirmation of the incident, which can come after discovery. Most state statutes run from discovery or notification of the breach, or from the firm’s determination that one occurred; each state row names its own trigger. This calculator counts every dated clock from the day your firm found out, so where a statute runs from a later event, the date shown is the earlier, cautious one.

The FTC and SEC Regulation S-P rules count days, and the SEC service-provider rule counts hours. The state statutes this calculator carries count days too, except where a row says business days, as Vermont’s notice to its Attorney General does. None of them moves a deadline that lands on a weekend or a holiday, so this calculator never moves one. The IRS reporting standard is the exception: Publication 1345 says to report as soon as possible, and no later than the next business day after confirmation of the incident.

Day 1 is the day after discovery, so an event discovered on March 1 must be reported to the FTC by March 31. The notice is due as soon as possible, and 30 days is the outer limit. It applies only when the notification event involves the information of at least 500 consumers (16 CFR 314.4(j)(1)).

It depends on what the firm does, who regulates it, and where the affected people live. The FTC Safeguards Rule covers an accountant or other tax preparation service in the business of completing income tax returns (16 CFR 314.2(h)(2)(viii)). It also names “investment advisors that are not required to register with the Securities and Exchange Commission” (16 CFR 314.1(b)). SEC Regulation S-P covers investment advisers registered with the SEC (17 CFR 248.1(b)), and its breach notice rule applies to them as covered institutions (17 CFR 248.30(d)(3)). For lawyers, a federal appeals court held in ABA v. FTC (D.C. Cir. 2005) that the FTC’s attempt to regulate the practice of law under the Gramm-Leach-Bliley Act’s privacy provisions fell outside its statutory authority. The case did not address the Safeguards Rule by name. The IRS reporting standard in Publication 1345 applies to Authorized IRS e-file Providers of individual income tax returns. Wisconsin’s statute turns on where a firm does business and whose personal information it holds, not on its profession (Wis. Stat. 134.98(1)(a), (2)). Whether a rule reaches your firm is a question for your counsel.

Each state’s statute protects its own residents, so a breach that reaches clients in three states can run three state clocks. Some statutes also reach a firm based in the state: Wisconsin’s covers a firm with its principal place of business there for every person affected. A few bind only certain businesses; Georgia’s reaches information brokers and state agencies. Add every state where affected people live, and your own. Whether a statute reaches your firm is a question for your counsel.

Of the 50 jurisdictions this calculator carries, 22 set a fixed outer limit to notify affected residents: 30 days in California, Colorado, Florida, Maine, New York and Washington; 45 days in Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont and Wisconsin; 60 days in Connecticut, Delaware, Louisiana, South Dakota and Texas. The rest require notice without unreasonable delay and set no number of days. The calculator carries no figure Claremont has verified for Nevada.

Only for the SEC service-provider clock, and only once that rule is on. It runs 72 hours from the moment the provider becomes aware of the breach, so the deadline has a time of day. The calculator counts elapsed hours in your browser’s time zone, and says so if a daylight saving change falls inside the 72 hours.

It may not. Wis. Stat. 134.98(3m) says the section does not apply to an entity that is subject to, and in compliance with, the privacy and security requirements of the Gramm-Leach-Bliley Act (15 USC 6801 to 6827), if it has a policy concerning breaches of information security in effect. Whether your firm meets that test is a question for your counsel. Where the section applies, notice is due within a reasonable time, not to exceed 45 days after the firm learns of the acquisition.

No. The dates are worked out in your browser and nothing you enter is transmitted. The calendar file and the copied schedule are built on your device.