What Should a Small Business Do After a Data Breach?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

If personal data your business holds is lost, stolen, or seen by the wrong person, act in this order: stop the leak, keep the evidence, find out what was taken and whose it was, write everything down, and then notify the people the law requires. Every state has its own breach notice law, and some federal rules add more. Call a privacy attorney and your cyber insurer early, because deadlines can be short.

What this means

A data breach is any time personal information leaves your control without permission. It can be a hacked email account, a lost laptop, a stolen file box, a vendor that got hacked, or an employee who emailed a customer list to the wrong person.

The outline asks for four steps:

Investigation: find out what happened, what data was involved, and whose it was.
Containment: stop the leak and keep it from getting worse.
Documentation: keep a written record of every step, every decision, and every date.
Notification: tell the people, agencies, and businesses that need to know.

It also covers 11.5.9, the breach response line in your data map. Your data map (see 11.5 Data Map) tells you what data you hold and where. That’s what makes a breach investigation fast instead of a guessing game.

Made-up example: An office assistant at Pine Ridge Tax and Bookkeeping clicks a fake login page. Two days later, the owner notices client emails being forwarded to an unknown address. She changes the password, removes the forwarding rule, and calls her information technology (IT) help and cyber insurer. The data map shows that the inbox held tax documents with Social Security numbers. Her attorney walks her through the state notice rules and the Federal Trade Commission (FTC) reporting rule that applies to tax preparers.

Why it matters

Every state requires breach notice. The FTC says all states, plus Washington, D.C., Puerto Rico, and the Virgin Islands, have laws that require notice when certain personal information is breached. Deadlines and triggers vary.
Some businesses have federal rules on top. Under the FTC Safeguards Rule, non-bank financial businesses such as tax preparers, mortgage lenders, and some car dealers must tell the FTC within 30 days of finding a breach that affects 500 or more people. Health care providers covered by the Health Insurance Portability and Accountability Act (HIPAA) must notify affected people within 60 days of discovery.
Evidence disappears fast. Wiping a computer or deleting emails can destroy what investigators and your insurer need.
Silence costs more trust than the breach. Customers who find out from someone else are the ones who leave and post reviews.

Who this applies to

Every business that keeps personal information about customers, employees, or vendors. That includes names with account numbers, Social Security numbers, driver’s license numbers, payment card data, health information, and logins. If you only hold names and email addresses, the state notice rules may not apply, but you should still follow the containment and documentation steps. Check your state’s law to see what counts.

How to do it

Prepare now:

Build your data map so you know what personal data you hold, where it lives, and who can reach it (see 11.5 Data Map).
Write a one-page breach checklist with the steps below and the phone numbers of your attorney, insurer, IT help, bank, and local police. Print it. A breach may lock you out of the computer that holds it.
Learn your notice rules ahead of time. Find your state’s breach law through your state attorney general’s website, and ask your attorney which federal rules apply to your industry (see 11.6.6 Breach Notification).
Read your cyber insurance policy so you know who to call first (see 10.8.6 Cyber Insurance). Some policies require you to use their approved vendors.
Check vendor contracts so vendors must tell you quickly if they have a breach (see 11.2.7 Data-Processing Terms).

If it happens:

Contain it. Change passwords, remove access, and take affected equipment off the network. The FTC says not to turn machines off until forensic experts arrive, because that can erase evidence.
Start a log. Write down the date and time you found out, who found it, and every action from here on.
Call your insurer and attorney. They help decide the order of the next steps.
Bring in a forensic expert if the breach involved systems you can’t fully check yourself.
Report to law enforcement. The FTC suggests calling local police right away, and the Federal Bureau of Investigation (FBI) or U.S. Secret Service if local police lack the expertise. Ask law enforcement whether notice should wait so it doesn’t harm their investigation.
Figure out what was taken and whose it was. Use your data map. Count the people affected in each state, because state rules depend on where people live.
Fix the hole. Close the gap that let it happen, and confirm vendors have fixed theirs.
Remove exposed data from your website if any was posted there, and check whether it was posted elsewhere.
Send required notices. With your attorney, notify affected people, state agencies, federal agencies, credit bureaus, or other businesses as the rules require. The FTC suggests telling people what happened, what information was involved, what you’re doing, and what they can do, with a contact person to call.
Post a short, honest update on your website if customers will search for answers. Keep it factual.
Review what happened and update this plan.

What proof to keep

The incident log with dates, times, and actions
Forensic reports and IT notes
Police report numbers and agency report confirmations
Insurer claim number and adjuster contact
A copy of every notice sent, who got it, and the date sent
The list of affected people and their states, stored securely
Notes from your attorney on why each notice decision was made

Keep these in a restricted folder. If a claim or lawsuit is possible, your attorney may put them under a legal hold (see 9.8.6 Legal Hold).

Common mistakes

Wiping or rebuilding computers right away. You lose the evidence that shows what was or wasn’t taken.
Waiting to be sure before calling anyone. Some deadlines start when you discover the breach, not when you finish investigating.
Forgetting vendor breaches. If your scheduling software or payroll provider is hacked, your customers’ data may still be your problem.
Saying too much too soon. Early public statements that turn out wrong hurt trust. Share facts as they’re confirmed.
Only checking your own state. Notice rules follow where the affected people live.
Treating it as an IT problem only. Breaches are legal events too.

When to get help from a pro

Privacy attorney: as soon as you suspect personal data was exposed. Cyber insurance agent: to start a claim. IT security or forensic specialist: to contain and investigate. Questions to ask:

Which state and federal notice rules apply to us, and what are the deadlines?
Does what happened count as a breach under those laws, or only a security incident?
What should our notice letter say, and who else must we tell?

Bill’s note

[Bill: add a short note. For example, a time a small business you worked with had a hacked email or website, what they did first, and what you’d tell them to do differently. Or how SiteSmarty limits the client data it holds so a breach would touch less.]

If you’d rather have help locking down your website after a security problem, SiteSmarty handles website setup and care.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the SiteSmarty data map, breach checklist, and contact list]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the printed breach checklist and the restricted incident folder]
[Result so far:]

Questions people ask

Who do I have to notify after a data breach? It depends on what data was taken, where the affected people live, and your industry. It can include the affected people, a state agency, a federal agency, credit bureaus, and other businesses. Ask a privacy attorney.

Should I call the police? Yes. The FTC suggests calling local police right away, and the FBI or Secret Service if local police can’t handle it.

How fast do I have to tell customers? Deadlines vary by state and industry. HIPAA covered entities have no more than 60 days after discovery. Check your state’s deadline early, because the clock may already be running.

Do I need to notify anyone if only email addresses leaked? Often not for email addresses alone, but some states count an email address or username plus a password as personal information. Check your state’s law with an attorney.

Audit check

Question: Does the business have a written data breach plan with containment, investigation, documentation, and notification steps, plus a current data map and contact list?
Pass looks like: A printed checklist, a data map less than a year old, known state and federal notice rules, an attorney and insurer on the contact list, and vendor contracts that require breach notice.
Fail looks like: No plan, no idea what personal data is held or where, contacts stored only on the computer that could be compromised.
Evidence to collect: The breach checklist, the data map, the cyber policy contact page, and any incident logs from past events.

Where this fits

Do this first: 11.5 Data Map, 11.6.6 Breach Notification, 11.9.3 Ransomware

Do this next: 11.9.5 Payment Fraud

Sources

Federal Trade Commission, "Data Breach Response: A Guide for Business" (checked October 17, 2026)
Federal Trade Commission, "Safeguards Rule notification requirement now in effect" (checked October 17, 2026)
U.S. Department of Health and Human Services, "Breach Notification Rule" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.