Data breach response for startups: what founders should know

October 13, 2026

A data breach starts legal clocks as soon as you discover it. Every US state has a breach-notification law, GDPR gives you 72 hours to notify regulators, health and financial data have their own deadlines, and your customer contracts probably promise notice within a few days. Preventing breaches is mostly an engineering job. Responding to one is mostly a legal job, and the first calls you make, to your insurer, your lawyer and a forensics firm, shape everything that follows.

Key takeaways

All 50 states have breach-notification laws, with different definitions, deadlines and attorney general notice rules. Where your affected people live decides which apply.
GDPR requires notice to the regulator within 72 hours. HIPAA, the FTC’s Safeguards Rule and its Health Breach Notification Rule add their own deadlines.
Read your customer contracts. Enterprise agreements often require notice within 24 to 72 hours.
If you have cyber insurance, call the insurer first. Most policies require you to use their approved lawyers and forensics firms.
Have counsel direct the investigation so the analysis is more likely to stay privileged.

Who do I have to notify, and how fast?

It depends on what data was exposed, where the affected people live, and what you’ve promised in contracts. For a typical US software startup:

Who	When it applies	Deadline
Affected individuals	Personal information as defined by each state’s law (usually name plus a Social Security number, driver’s license, financial account or login credentials)	Varies by state. Many say “without unreasonable delay,” and many set an outer limit of 30 to 60 days.
State attorneys general	Many states, once the breach affects more than a set number of their residents (often 500 or 1,000)	Usually at or before notice to individuals
EU or UK regulator	Personal data of people in the EU or UK, unless the breach is unlikely to put them at risk	72 hours from becoming aware. Affected people must be told without undue delay if the risk is high.
Individuals and HHS (HIPAA)	Protected health information handled for a healthcare provider or health plan	Within 60 days. Breaches of 500 or more people also go to HHS and the media.
FTC (Safeguards Rule)	Non-bank financial companies, such as many fintechs, when 500 or more people’s unencrypted information is affected	Within 30 days of discovery
FTC and individuals (Health Breach Notification Rule)	Health and wellness apps not covered by HIPAA	Within 60 days
Your customers	Whatever your contracts say	Often 24 to 72 hours

The state laws differ in what counts as personal information, whether encrypted data is exempt, and what the notice must say. Don’t guess. Have counsel map the affected people by state.

What should I do in the first 72 hours?

Contain the breach: isolate affected systems, reset credentials and preserve logs. Don’t wipe evidence.
Call your cyber insurer and give notice under the policy.
Call your lawyer, who engages the forensics firm so the investigation is directed by counsel.
Start a written timeline: when you discovered it, what data was involved, whose data, and what you’ve done.
Check your contracts for customer notice deadlines and the GDPR 72-hour clock if EU or UK data is involved.
Decide, with counsel, who must be notified and when, and prepare consistent messages for customers, users, employees and investors.

Tell your investors and board early. They’d rather hear it from you than from a customer.

Can a breach also violate privacy laws?

Yes. California lets consumers sue for statutory damages when certain personal information is breached because a business failed to maintain reasonable security, which drives class actions. Most of the newer state privacy laws require covered businesses to maintain reasonable security, and the FTC treats weak security that contradicts your privacy promises as deceptive. A breach is often both a notification event and evidence of a separate violation. See US Data Privacy Laws.

What do enterprise customers require in the contract?

Larger customers will send a security questionnaire and a security addendum or data processing agreement before they sign. Expect requirements to maintain a written security program, notify the customer of a breach within a short period, cooperate in the investigation, reimburse notification costs, and maintain cyber insurance. Many will ask for a SOC 2 report once you’re selling to mid-market or enterprise buyers.

Push back on two things: unlimited liability for data breaches (offer a higher “super cap” instead) and a notice period shorter than you can realistically meet. A deadline of 72 hours from confirming a breach is easier to meet than 24 hours from suspecting one. See How Do I Negotiate Customer Contracts as a Startup?

Do we need SOC 2, HIPAA compliance, or both?

They aren’t alternatives. SOC 2 is an audit report on your security controls that B2B buyers ask for. It isn’t a law. HIPAA is a law that applies only if you handle protected health information for a healthcare provider, health plan or their business associates, in which case you’ll sign business associate agreements and must meet its security rules. A health-tech startup selling to hospitals may need both.

Do I need cyber insurance?

If you hold customer data or sell to businesses, probably yes, and many enterprise customers will require it. A good policy covers forensics, legal counsel, notification, credit monitoring, regulatory defense and claims by third parties. Read the exclusions and the security conditions, such as multi-factor authentication. Most policies require you to use the insurer’s approved breach lawyers and forensics firms and to notify the insurer promptly, so put the insurer’s breach hotline in your incident response plan. See What Should Founders Know About Startup Insurance and Accounting?

How do I reduce the risk?

Collect only the data you need and delete what you no longer use. Require multi-factor authentication everywhere, encrypt data in transit and at rest, limit access to the people who need it, keep software patched, and vet the security of vendors who hold your data. Write a short incident response plan that names who does what and lists your insurer, lawyer and forensics contacts, and walk through it once a year. Encrypted data is exempt from notification under many state laws, which makes encryption one of the most valuable legal protections you have. See What Are the Startup Best Practices for Data Privacy?

For EU and UK rules, see GDPR Basics. If you’ve had a breach or want help with a security addendum or data processing agreement, contact us.