Under Pressure Balancing Privacy Breach Notification with IR

The talk looks at the legal side of responding to a data breach, focusing on when and how an organization must notify regulators, affected people and others. The speaker describes a patchwork of state rules with different deadlines, some measured in 12, 24 or 48 hours, along with requirements to notify state attorneys general and internal stakeholders.

The discussion then moves to federal and sector-specific rules. One example is a reporting requirement for rail operators to report cyber incidents on critical infrastructure within 24 hours. The speaker also covers affirmative defense provisions, which can give credit to organizations that had a recognized security framework in place. Cases where data was only possibly accessed, or where ransomware is involved, are presented as harder to classify under these rules. Questions from board members about cost and the effect on the bottom line are raised as well.

Audience questions close the session. The speaker suggests consulting legal counsel when a question falls outside what can be answered directly, and argues that meeting compliance obligations is not the same as being secure. The practical takeaway is that incident response plans should account for these deadlines and involve counsel before an incident happens.