There are specific considerations when determining if a breach is reportable. Notifications may only be given by specific methods. The breach notification law applies to any person or entity conducting business in the state who licenses or maintains personal information in the course of business.

If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.

Vendors must notify Organizations upon discovery of a breach or suspected breach. The Organization is responsible for submitting any required regulatory reporting and consumer notifications. Vendors must cooperate with Organizations by providing all necessary information about a breach.

Organizations may be fined or penalized for Vendor violations. The Attorney General may bring a civil action for violations of and enforce compliance with security breach requirements.