A U.S. data breach is not one legal category. The information exposed, your state, and the organization involved determine which rules may apply.
A notice alone doesn't guarantee money. It doesn't create a nationwide right to delete stolen data, either. There is no single nationwide notice deadline.
Treat the response as separate tracks: the breach notice, a privacy request, a regulator complaint, and a money claim. They can overlap, but each follows a different process. This is general information, not legal advice.
What actually controls your rights
The name on the notice won't settle the legal question. The data type and the organization's role matter more.
| Problem | Rule or route that may apply | What it usually means |
|---|---|---|
| Breach notification | State breach-notification law or a sector rule | A business may have to notify affected residents when covered information is accessed or acquired. Timing and wording vary. |
| Access, correction, or deletion | State privacy law, contract, or HIPAA record rights | You may be able to request information or changes, subject to identity checks and exceptions. |
| Medical information | HIPAA, state health privacy law, or both | HIPAA may provide a complaint route and record-access rights. It generally does not create a private damages lawsuit. |
| Biometric information | Illinois BIPA or another state law | Consent, collection, disclosure, retention, and security practices can all matter. |
| Money claim | A statute, contract, negligence theory, or settlement | A notice is not a promise of compensation. Actual harm and legal eligibility may matter. |
Notice law and privacy-request law answer different questions. State breach laws usually govern when a company must alert people, while state privacy laws may give eligible consumers access, deletion, correction, or opt-out rights.
Your company's privacy policy isn't national law. It can explain where to send a request, but the applicable law controls whether the company must comply.
Start with the breach notice
Read the notice, even if it says little. It may call the data "personal information" without naming every field. Frustrating, yes. Save it anyway.
- Confirm the notice is genuine. Use the company's known website or phone number instead of clicking an unexpected email link. Make sure the notice names the organization and provides a contact method.
- Identify the exposed fields. Credentials, Social Security numbers, payment details, medical records, and biometric information create different risks.
- Secure affected accounts. Change reused passwords and turn on multifactor authentication. Contact your bank or card issuer about suspicious transactions. If a government ID or Social Security number was exposed, consider a credit freeze or fraud alert.
- Create an incident file. Keep the notice, screenshots, login alerts, account statements, and a record of dates, calls, expenses, and time spent responding.
- Ask focused questions. Request the categories of information involved, the date the organization discovered the incident, the steps taken to contain it, and any protection or monitoring being offered.
- Track each deadline separately. Payment disputes, privacy requests, regulatory complaints, settlement claims, and lawsuits may all use different time limits.
Report unauthorized transactions promptly. Payment rules and account agreements are separate from a privacy claim against the breached company.
How privacy requests work after a breach
Qualifying California consumers may have CCPA and CPRA rights to access, delete, correct, or limit certain uses of personal information. Other states have similar rights, but their coverage, exceptions, and response periods differ.
A breach itself doesn't place every company under every privacy law. Business size, residency, the data involved, and sector exemptions can change the answer.
An access request can be the better first move, it turns out. It may show what information the organization still holds, how it classifies the data, and whether another service provider handled it.
Deletion can help, but it has limits. Legal obligations, security purposes, transactions, and other exceptions may allow a company to keep or use some information.
Deletion can't pull information back from an attacker. It removes or limits data held by the organization receiving your request.
Make the request in writing. Include your name, account email, state, exact request, date, and a secure way to receive a response. Use the company's privacy or security contact and follow its identity-verification process. Don't send a full Social Security number or medical file through ordinary email.
If health information was exposed
HIPAA starts with the organization, not simply the data. It may apply when the information came from a covered health care provider, health plan, health care clearinghouse, or business associate working for one. It doesn't automatically cover every wellness app, employer file, or consumer health service.
For a breach of unsecured protected health information, affected people generally must receive notice without unreasonable delay and no later than 60 days after discovery. That is the organization's notification obligation, not a universal deadline for you to sue.
Anyone can file a complaint about possible noncompliance with the HIPAA Privacy, Security, or Breach Notification Rules, or a Part 2 violation involving certain substance use disorder records. The HHS complaint process explains the available filing methods, and the HHS OCR complaint portal provides an online route.
Complaints generally should be filed within 180 days after you knew or should have known about the problem. OCR may allow more time for good cause.
Include the organization's name, relevant dates, a clear description, and useful records. Use a secure submission method when possible because unencrypted email can expose personal information.
OCR can investigate or pursue compliance. HIPAA itself generally does not let an individual bring a private damages lawsuit.
California and other state privacy claims
California has two separate lanes: breach notification and broader privacy rights.
The CCPA and CPRA private right of action is narrow. It generally concerns certain security breaches involving specified personal information and inadequate security, not every CCPA violation or every exposure.
Receiving a breach notice does not prove that a lawsuit exists. The data category, security evidence, harm, timing, and legal procedure can all matter.
Other states may provide access, deletion, correction, or opt-out rights. Some also protect specific types of information or exclude employee, business-to-business, small-business, or regulated data. Check the law connected to your residence and the company involved instead of relying on a generic national privacy form.
Biometric data needs a closer look
Biometric incidents can create two separate disputes. One concerns collection; the other concerns security.
Illinois BIPA addresses written notice and written release before certain biometric information is collected. It also restricts some disclosures and permits private claims for qualifying violations. The Illinois BIPA text and 2024 amendment lets you check the exact language.
The 2024 amendment changed how recoveries may be calculated in some situations. Older headlines that multiply $1,000 or $5,000 by every scan may not describe the amount recoverable in every case.
Keep consent screens, enrollment forms, app settings, and the breach notice. A security incident does not prove that collection lacked consent, and a consent dispute does not prove a breach.
Does a data breach qualify for compensation?
Compensation isn't automatic. Money may come from a bank or card reimbursement, documented identity-theft losses, a statutory claim, a settlement, or a court judgment. Each route asks a different question.
| Possible source of money | What you may need to show |
|---|---|
| Bank or card reimbursement | An unauthorized transaction and prompt reporting under the relevant payment rules |
| Documented expenses | Receipts, fees, lost funds, or other losses connected to the incident |
| Statutory claim | The law covers the data, conduct, person, and legal procedure |
| Class settlement | You qualify under the settlement and meet the claim deadline |
| Individual lawsuit | A viable legal theory, evidence, causation, and recoverable harm |
Credit monitoring helps protect you. To be honest, it doesn't prove liability.
Keep records of monitoring, replacement documents, professional fees, missed work, and fraudulent charges. Don't assume every expense will be recoverable.
A class action may offer a practical route when many people were affected. It can also involve a release of individual claims, an arbitration issue, or an opt-out deadline.
Read the settlement notice before submitting a claim or signing anything, especially if the breach caused serious financial loss or identity theft.
Where to escalate an unanswered complaint
Give the company's breach or privacy contact the first chance to answer. Send a short written follow-up that lists your original request, the date you submitted it, and the response you need.
State privacy or breach issues may belong with the state attorney general or another state regulator. HIPAA issues go to OCR. Identity theft and unauthorized transactions should be reported to the financial institution promptly, along with any required reports.
A regulator complaint can support enforcement, but it may not recover money for you. Keep the complaint number, submitted documents, and every response.
What the GDPR 72-hour rule means for U.S. consumers
The GDPR's 72-hour rule has a narrower reach. Thing is, it isn't automatically the rule for every U.S. consumer.
A global company may have obligations to people in the European Union or European Economic Area, but that depends on the organization, its activities, and the person's connection to the processing.
The familiar 72-hour period generally concerns a controller notifying a supervisory authority. It is not a universal 72-hour deadline for notifying every affected person.
The GDPR right to erasure also has exceptions. It can't retrieve copies already taken by an attacker.
If a company invokes GDPR in your situation, ask which jurisdiction it believes applies and which request process it is offering.
Your next move
Save the notice today and write down the fields it names. Change reused passwords, turn on multifactor authentication, and contact your financial institution about suspicious activity.
Health records and biometrics need their own complaint and request routes, so use the relevant process instead of waiting for a general support response.
If you have significant losses, get jurisdiction-specific legal advice before signing a release.