- [Narrator] In the unfortunate event
of a known or suspected data breach
information security professionals
have a range of responsibilities dictated
by laws and regulations.
Like many other security regulations in the United States,
data breach laws are a patchwork of regulations
that apply in different ways.
Some rules apply to specific industries
such as HIPPA for the healthcare industry
or PCI DSS for the credit card industry.
Other data breach regulations
apply to specific jurisdictions.
Such as the state by state data breach notification laws.
Generally speaking these laws apply
when an organization knows or suspects
that it has suffered a breach
of personally identifiable information or PII.
The specific definition of PII
varies from state to state.
But there are several common elements found in these laws.
They often include social security numbers,
drivers license numbers and bank account numbers
but they may extend to other information as well.
Some of common requirements
when an organization suspects a breach
include notifying affected individuals
and potentially notifying government agencies
or law enforcement.
Often organizations also offer credit monitoring services
or other compensation to the victims of the data breach.
As a security professional you will need to remain
aware of the laws that apply in the jurisdictions
where you do business.
The National Conference of State Legislatures
maintains a website that links to the
data breach notification laws
of the states that have one in place.
It also lists the states that do not have a current
data breach notification law.
Currently that list includes
Alabama, New Mexico and South Dakota.
Every other state has a data breach notification law.
One quick exam tip for you,
encryption is an easy way to protect your organization
against data breaches.
In fact, many data breach notification laws
includes specific exemptions for encrypted data.