Several regimes, one incident
Which obligations apply usually depends on where the affected people live rather than on where your company sits, so a customer list spread across the country can bring in many sets of rules at once. Layered over those are sector-specific requirements for health, financial, education, and government-facing information, along with the terms of your own contracts with business customers, which often commit you to telling them on terms they set. If any affected individuals are residents of other countries, foreign requirements may reach you as well. These overlap rather than replace one another, and the strictest of them tends to set the pace for everything else. Working out which of them apply is part of the analysis rather than a formality that follows it.
The facts that drive the decision
Data breach notification turns on establishing precisely whose information was involved and what kind of information it was. A list of names and email addresses is a different matter from identifiers that open an account, or from files carrying health or financial detail, and the analysis usually asks whether data was actually accessed or acquired rather than merely exposed to the possibility. Whether it was encrypted, and whether the key was reachable, frequently changes the answer. This is why the technical investigation and the legal analysis have to run alongside each other, since who must be told cannot be settled ahead of what was taken. Announcements built on a first estimate are commonly corrected later, and the correction becomes a problem of its own.
Individuals are not the only audience
Regulators, and in some situations consumer reporting agencies, may need to hear from you separately from the people whose information was involved, and what they receive is not the same content. Business customers often have to be told so that they can meet obligations running further downstream. The wording of a notice matters more than it appears to: what it says about cause, scope, and what you are offering can be read back to you afterward, and saying too little invites a second round while saying too much commits you to facts that may still shift. We usually draft the notice alongside the investigation rather than at the end of it. Reviewing a draft early is far easier than untangling a notice that has already gone out to everyone on the list.
