The FTC's 30-day breach notice, explained

What triggers it

“Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.”

Two details matter. Information counts as unencrypted if the encryption key was also accessed. And unauthorized access is presumed to be acquisition unless you have reliable evidence it wasn't, or couldn't reasonably have been, taken.

The deadline

“if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event”

The clock starts on the first day the event is known to you, and it counts as known to you once any employee, officer or other agent knows, other than the person who committed the breach.

What the FTC's form asks for

• Your business's name and contact information.
• The types of information involved.
• The date or date range, if it can be determined.
• How many consumers were or may have been affected.
• A general description of what happened.
• Whether law enforcement has asked in writing to delay public notice, and how the FTC can reach them.

Be ready before it happens

• Bookmark the FTC's Safeguards Rule reporting form with your emergency contacts.
• Encrypt laptops and customer files, so a lost device is far less likely to be a notification event.
• Log every incident with the date it was discovered and how many consumers were involved; Safeguards Tracker shows the FTC deadline the moment an incident reaches 500 consumers (314.4(j)).
• Check your state's breach laws too: they can require separate notices to customers and the state.