State Data Breach Notification Laws: A Working Checklist for CPA Firms

Every state has its own breach notification statute, and a CPA firm's client list rarely stays inside one state. A firm in Dallas may prepare returns for clients who moved to Florida, own property in New York or retired to California. When client data is exposed, each of those residents may be owed a notice under their own state's law, with its own deadline and its own regulator.

This checklist sets out the questions to answer for each state in the affected-person list, with examples from four state statutes. It is a framework, not a fifty-state survey, and counsel should confirm the current text of each statute before notices go out.

Why does residency drive the analysis?

State breach laws generally protect the state's residents, so the law that applies follows where the affected person lives, not where the firm sits. Texas makes this explicit: for an individual who lives in another state that has its own notice law, Texas allows the notice to be given under that state's law or under the Texas rule (Tex. Bus. & Com. Code 521.053(b-1)).

The first task is therefore a clean affected-person list with a state of residence for each person. Use the most recent address in the tax file, and flag clients who moved during the year. The first 72 hours guide explains when to build this list.

Question 1: Is the data "personal information" under this state's law?

Definitions differ. Most combine a name with a sensitive element such as a Social Security number, driver's license number or financial account number. Some go further. New York's definition of private information, in General Business Law 899-aa, includes biometric data, medical and health insurance information, and a username or email address combined with a password or security question.

For a tax practice, assume most return files meet every state's definition: they hold names, SSNs and often bank account numbers for refunds. The harder cases are partial data sets, such as an engagement letter folder with names and emails but no SSNs.

Question 2: Does an encryption safe harbor apply?

Most states exclude encrypted data, but the exception has limits. New York treats encrypted data as private information if the encryption key was also accessed or acquired. Florida excludes information that is encrypted, secured or modified by another method that removes the identifying elements or otherwise renders it unusable. The federal Safeguards Rule takes the same key-compromise approach for its FTC notice.

If the attacker used a staff login, assume the data was readable.

Question 3: Is there a risk-of-harm exception, and what must be documented?

Some states let a business skip individual notice after a documented determination that harm is unlikely. Florida's statute, at 501.171, allows this where, after an appropriate investigation and consultation with relevant law enforcement agencies, the business reasonably determines the breach has not and will not likely result in identity theft or other financial harm. The determination must be documented in writing, kept for at least five years and provided to the Florida Department of Legal Affairs within 30 days.

For SSN-level tax data, a no-harm conclusion is hard to support. If the firm relies on one, the documentation needs to be strong.

Question 4: What is the deadline to notify residents?

Deadlines run from different triggers and use different words. Examples:

Use the shortest applicable deadline as the working target for everyone. A single mailing date is easier to manage and defend than staggered notices.

Question 5: Must a state regulator be notified?

Many states require notice to the attorney general or another agency, often above a resident count. Examples:

• Texas: If the breach involves at least 250 Texas residents, notice goes to the attorney general through the AG's electronic form, as soon as practicable and no later than 30 days after the determination.
• Florida: A breach affecting 500 or more individuals in Florida requires notice to the Department of Legal Affairs within 30 days.
• New York: Notice goes to the attorney general, the department of state and the division of state police. The Department of Financial Services is also notified if the business is a covered entity under its cybersecurity regulation.
• California: The attorney general's office states that a business notifying more than 500 California residents of a single breach must submit a sample copy of the notice to the attorney general, under Civil Code 1798.82.

Separately, the IRS tells tax professionals to report data theft to the state tax agencies where they prepare returns. That is a fraud-prevention report, distinct from the consumer protection notice.

Question 6: Must the credit bureaus be told?

Large notices often trigger a duty to tell the nationwide consumer reporting agencies. Texas requires it when more than 10,000 persons are notified at one time; Florida when more than 1,000 individuals are involved; New York when more than 5,000 New York residents are notified at one time. The IRS also lists notifying the three credit bureaus as a step after tax data theft.

Question 7: What must the notice say?

Content rules vary. Some states prescribe headings, some require specific contact information, and some require an offer of credit monitoring for SSN breaches. The IRS notes that some states require offering monitoring to victims. Build one master letter, then check it against each state's content list.

Question 8: Can law enforcement delay the notice?

Most statutes allow delay when law enforcement says notice would impede an investigation. Florida requires a written request from the agency. Get the request in writing and keep it in the file.

How do the federal tracks fit in?

State notices sit alongside two federal steps for a tax practice:

• FTC notice under the Safeguards Rule if 500 or more consumers are involved, within 30 days of discovery. See the FTC notification event guide.
• IRS Stakeholder Liaison report as soon as possible.

The checklist

For each state with an affected resident:

1. Count of residents, with data elements involved.
2. Does the data meet the state definition? Encryption exception available?
3. Risk-of-harm exception available, and is the firm relying on it? Documented?
4. Resident notice deadline and trigger date.
5. Regulator notice: threshold, recipient, method, deadline.
6. Credit bureau notice threshold.
7. Notice content requirements, including credit monitoring.
8. Law enforcement delay request on file, if any.
9. Date each notice was sent, and proof of sending.

Keep the completed checklist with the incident file. The data theft response plan should point to it.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• Texas Legislature, Business and Commerce Code chapter 521, including 521.053, Notification required following breach of security: https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm
• New York State Senate, Senate Bill S2659B (2023-2024), amending General Business Law 899-aa (30-day notice and Department of Financial Services notice): https://legislation.nysenate.gov/pdf/bills/2023/S2659B
• Florida Legislature, Florida Statutes 501.171, Security of confidential personal information: https://www.flsenate.gov/Laws/Statutes/2024/501.171
• New York State Senate, General Business Law 899-AA, Notification; person without valid authorization has acquired private information: https://www.nysenate.gov/legislation/laws/GBS/899-AA
• California Attorney General, Data Security Breach Reporting: https://oag.ca.gov/privacy/databreach/reporting
• Internal Revenue Service, Data theft information for tax professionals: https://www.irs.gov/individuals/data-theft-information-for-tax-professionals

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error