Law changelog
When the law moves, the dataset moves, and we log it here. Target: any effective change reflected within seven days.
Territory & substitute-notice pass
Statute-verified US Virgin Islands, Guam, and Puerto Rico (DACO 10-day rule); corrected New Jersey (no numeric individual deadline; State Police notice precedes customers) and confirmed Tennessee (45 days) and DC (AG at 50 residents). Encoded deviating substitute-notice thresholds for AK, HI, ID, NH, VT, OK.
Federal overlays confirmed
HIPAA, FTC Health Breach Notification Rule (500+ now contemporaneous with individual notice, not 10 business days), FTC Safeguards Rule (30 days, ≥500), and NYDFS §500.17 (72 hours) parameters verified against the CFR.
California SB 446 in effect
Hard 30-day individual-notice deadline replaces 'without unreasonable delay'; sample notice to the AG within 15 days of notifying individuals (>500 CA residents). Engine and California letter format updated.
Oklahoma SB 626 in effect
Personal-information definition expanded to biometric and government-ID data; AG notice within 60 days of individual notice at 500+ residents; penalties up to $150,000/$75,000 with a reasonable-safeguards defense.
New York 30-day deadline
GBL §899-aa amended to a firm 30-day individual-notice deadline; medical and health-insurance information added to covered data.