Does a Small Business Have to Notify Customers After a Data Breach?

The short answer

Yes, it can. Every state has a law that requires notice when certain personal information is breached, and the rules differ by state. Before anything happens, name one person who decides whether an incident needs a notice, list the attorney and insurer they will call, and know which state laws and federal rules apply to the data you keep.

What this tells Google and AI

Breach notice planning is a foundation step. It sends no search signal. But breaches that are hidden or handled badly tend to become public through news, state notice lists, and angry reviews, and Google, Bing, and artificial intelligence (AI) tools pick up that public information. A calm, honest, on-time notice protects the trust your business has earned.

What this means

A breach is when someone who shouldn’t have personal information gets it. That could be a hacked email account, a stolen laptop, a file shared with the wrong person, or ransomware. Not every incident requires a notice. Whether one does depends on what data was involved, whether it was encrypted, where the affected people live, and the law of each of those states.

The Federal Trade Commission (FTC) says all states, plus the District of Columbia, Puerto Rico, and the Virgin Islands, have breach notice laws. Some federal rules apply too:

• Health data: The FTC Health Breach Notification Rule or the Health Insurance Portability and Accountability Act (HIPAA) breach rule may apply.
• Financial businesses: The FTC Safeguards Rule covers businesses like tax preparers, mortgage brokers, and collection agencies. Since May 2024 they must notify the FTC within 30 days after finding a breach of unencrypted information about at least 500 consumers.

This page is about who decides and who gets told. The step by step response to a breach is in 11.9.4 Data Breach Response.

Made-up example: Cedar Street Bookkeeping has one owner and two staff. The owner writes down that she decides on breach notices, lists her attorney and her cyber insurance claim line, and notes that her clients live in two states. When a staff laptop goes missing later, she knows who to call first.

Why it matters

• Deadlines can be short. State laws set timing rules, and some require notice to the state attorney general too.
• Guessing goes wrong both ways. Over-notifying scares customers for no reason. Under-notifying can break the law.
• Insurers often have rules. Many cyber policies expect you to call them before you hire outside help. Read your policy (see 10.8.6 Cyber Insurance).
• Panic makes bad notices. The FTC warns against misleading statements or holding back details people need to protect themselves.

Who this applies to

Every business that keeps personal information about customers or employees. Employee tax forms count. Businesses in health, finance, and tax preparation have extra federal rules.

How to do it

1. Name the decision maker. Usually the owner. Name a backup in case they can’t be reached.
2. Build a contact sheet. Attorney, cyber insurer claim line, information technology (IT) help, bank, payment processor, and local police.
3. Mark what data could trigger notice. Use your data map to flag Social Security numbers, driver’s license numbers, financial account and card numbers, health data, and login credentials (see 11.6.2 Sensitive Information).
4. List where your customers and employees live. Notice rules follow the state where the affected person lives.
5. Find each state’s rules. Your state attorney general’s website usually explains the breach law and whether the office must be told.
6. Check federal rules for health or financial data.
7. Encrypt what you can. Many state laws treat encrypted data differently, so encryption can change whether notice is needed. Confirm with your attorney.
8. Ask vendors how they’ll tell you if they have a breach (see 11.2.7 Data-Processing Terms).
9. Save a notice template your attorney has reviewed. The FTC suggests a notice explain what happened, what was taken, what you’re doing, how people can protect themselves, and how to reach you.

What proof to keep

• The named decision maker and backup, in writing
• The contact sheet, kept where you can reach it if your systems are down
• Your list of states and the rules that apply
• An attorney-reviewed notice template
• For any incident: a dated log of what happened, who decided, and why

Common mistakes

• Waiting to see if anything bad happens before calling the attorney.
• Hiring a cleanup company before calling the insurer, which can cause coverage problems under some policies.
• Only checking your own state’s law. Customers in other states bring their states’ rules.
• Wiping a hacked computer right away. The FTC says don’t turn off affected machines until experts can look, so evidence is kept.
• Putting links in breach emails. Scammers copy breach notices. Tell people how you’ll contact them so they can spot fakes.

When to get help from a pro

Privacy attorney: before any breach, to review your plan and template, and right away after any incident. Cyber insurance agent: to explain what your policy requires. Questions to ask:

• Which state laws apply to the data I keep and where my customers live?
• Does encryption change whether I have to notify?
• Who do I call first under my insurance policy?

Bill’s note

[Bill: add a short note. For example, how SiteSmarty would decide on a notice if a client website or login were exposed, or why you think every small business should have an attorney’s number saved before they need it.]

How I did this for SiteSmarty

• [Date I did this:]
• [What I actually did, step by step: naming the decision maker and building the SiteSmarty breach contact sheet]
• [What it cost and how long it took:]
• [What surprised me or what I’d do differently:]
• [Screenshot or photo to add, with private info blurred: the breach contact sheet]
• [Result so far:]

Questions people ask

Do I have to tell customers about a breach? Often yes, depending on the data and the state. All states have breach notice laws, and they differ.

Who decides? Pick one person ahead of time, usually the owner, working with an attorney.

Do I have to tell the FTC? Some businesses do. Financial businesses under the FTC Safeguards Rule must notify the FTC within 30 days when unencrypted data on 500 or more consumers is taken. Certain health data businesses have their own FTC rule.

Who else do I notify? The FTC lists law enforcement, affected businesses and banks, and, when Social Security numbers are stolen, the major credit bureaus. Some states also require notice to the attorney general.

Audit check

• Question: Has the business named who decides on breach notices and written down who they will contact?
• Pass looks like: A named decision maker and backup, a current contact sheet stored offline, a list of states and rules, and an attorney-reviewed template.
• Fail looks like: No one named, contacts stored only in the email account that could be hacked, no idea which state laws apply.
• Evidence to collect: The written plan, contact sheet, state list, and template, with dates last updated.

Where this fits

Do this first: 11.5 Data Map, 11.6.2 Sensitive Information

Do this next: 11.6.7 Privacy Training

Related pages: 11.9.4 Data Breach Response, 11.9.3 Ransomware, 11.9.1 Lost Device, 10.8.6 Cyber Insurance, 6.3.1 Business Attorney, 11.2.7 Data-Processing Terms

Sources

• Federal Trade Commission, "Data Breach Response: A Guide for Business" (checked October 17, 2026)
• Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know" (checked October 17, 2026)
• Federal Trade Commission, "Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.