Breach Notification: What Employers Need to Know

Breach notification is the legal obligation to inform affected individuals, and often regulators, when personal information has been exposed. For employers, it applies to employee data as much as customer data, and it operates on timelines that begin running before most organizations have finished understanding what happened.

The obligation is what converts a security incident into a compliance event. An employer can often absorb the operational disruption of a breach. What it cannot do is quietly decide not to tell anyone.

What triggers the duty

Requirements vary by state, but the common structure is that notification is triggered by unauthorized acquisition of specified categories of personal information in unencrypted form. The categories typically include Social Security numbers, driver's license or state identification numbers, financial account numbers with any access code, medical information, and health insurance information. Many states have expanded the list to include biometric data and online account credentials.

Two features of that structure matter operationally. First, encryption is usually the pivot: properly encrypted data that is exposed frequently does not trigger notification at all, which makes encryption of employee records a compliance control and not merely a security preference. Second, the obligation attaches to the data holder — the employer — not to whoever suffered the intrusion, which is why a vendor breach generally becomes the employer's notification obligation.

The multi-state problem

Notification obligations follow the affected individual's residence, not the employer's location. An employer with employees in twelve states faces twelve sets of requirements simultaneously, differing in what data is covered, how quickly notice must be given, what the notice must contain, whether regulators or credit bureaus must be told, and at what threshold.

Timelines range from a specific number of days to a general "without unreasonable delay." Some states require notice to the attorney general above a threshold number of residents. Some prescribe content requirements the notice must satisfy. A single notice template will not satisfy every jurisdiction, and an employer discovering this during an incident is discovering it too late.

California imposes its own requirements, including specified content and formatting for notices and submission to the attorney general above a threshold. Employers with California employees should treat those requirements as a baseline they will need to meet in any significant incident.

Why the clock is the hardest part

The timeline generally starts at discovery, not at resolution. That creates a compressed sequence in which the employer must determine what data was involved, whose data it was, whether it was encrypted, which jurisdictions are implicated, and what each requires — while the incident response itself is still underway.

Organizations that have not prepared lose most of the available time to basic questions: what employee data do we hold, where does it live, which vendors have copies, and how do we produce a list of affected individuals with current addresses. An employer that can answer those in advance has a materially different experience than one starting from zero.

Legal counsel should be engaged early, both for the jurisdiction analysis and because the assessment work benefits from privilege considerations that are harder to establish retroactively.

Preparation that changes outcomes

• A data inventory covering what employee data is held, where, and which vendors have it. This is the single highest-return preparation item.
• Encryption of employee data at rest, which can remove the notification trigger entirely and, in California, bears on exposure to the private right of action for breaches of unencrypted data.
• Current contact information for employees and former employees, since notice must reach people who may have left years ago.
• Vendor contract terms requiring prompt notification to the employer, in a defined timeframe. A vendor that tells the employer three weeks later has consumed the employer's compliance window.
• A response plan naming individuals, not roles, with counsel and forensic support identified in advance.
• Draft notice templates reviewed against the jurisdictions where employees actually reside.

What notification involves in practice

Beyond the legal notice, employers generally offer credit monitoring where identifiers were exposed, stand up a channel for employee questions, and prepare for the internal reaction. That last element is consistently underestimated. Employees learning that their Social Security numbers were exposed through their employer's systems respond differently than customers do, because they had no choice about providing the data and cannot take their business elsewhere.

Communication quality matters accordingly. A notice that is clear about what happened, what data was involved, what the employer is doing, and what the employee should do preserves considerably more trust than one written purely to satisfy a statute.

The vendor dimension

Most employer breaches now originate at a vendor — a payroll processor, benefits administrator, or screening firm. The employer generally still owes the notification, still faces the workforce reaction, and still bears the cost, while depending on the vendor for the facts needed to notify accurately.

That dependency is worth addressing contractually before it is tested, through defined notification windows, cooperation obligations, and indemnification that reaches actual notification and monitoring costs rather than being capped at fees paid.

Employer's Guardian helps employers prepare for these obligations alongside their broader state requirements through California HR compliance, including data inventories, vendor terms, and workforce communication.

This article provides general educational information, not legal advice. Breach notification requirements vary by jurisdiction, are time-sensitive, and change over time. Engage qualified counsel immediately if you suspect a breach.