A Breach Notice Checklist for Small Business Owners: Clocks, Wording and the Public Page

Your customers' data is exposed, and "72 hours" is the only deadline you have heard of. It is one of several, and it is owed to a regulator, not to your customers. This is a checklist for the small business owner who has to act this week: what to record, which deadlines can apply, what the notice must say, and what to publish on your own site. It is general information, not legal advice. Your lawyer decides which rules apply to you.

1. Write down when you found out

Open one incident log today. Record who told you, by what channel, and when. That timestamp matters because each rule starts its clock from a different trigger.

Under GDPR Article 33(1) you notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware." Late is allowed if you give reasons. Partial is allowed, in phases. And a breach you decide not to report still has to be documented.

2. Map the clocks that apply to you

• GDPR (people in the EU): 72 hours after awareness, where feasible, to the regulator. Individuals are told "without undue delay" when the risk to them is high.
• California (residents' data): since January 1, 2026, disclosure within 30 calendar days of discovery or notification. If more than 500 residents are notified, a sample copy goes to the Attorney General within 15 calendar days of notifying them.
• HIPAA: individual notices without unreasonable delay and no later than 60 days after discovery.
• FTC Safeguards Rule (non-bank financial institutions): notify the FTC within 30 days of discovery of a breach affecting at least 500 consumers.
• SEC Form 8-K Item 1.05 (public companies): four business days after the company determines the incident is material.
• Everywhere else: every state, the District of Columbia, Puerto Rico and the Virgin Islands has its own law. Ask counsel to map the states where your customers live.

If the breach happened at a vendor, the duty to tell people usually stays with you. California requires the vendor to notify the data owner "immediately following discovery," and your own 30 days then run from that notification.

3. Use the required headings, wherever you are

California requires a notice titled "Notice of Data Breach" with five headings: What Happened? What Information Was Involved? What We Are Doing. What You Can Do. For More Information. They make a good skeleton for any notice. If a Social Security or driver's license number was exposed and you were the source, California also requires at least 12 months of identity theft prevention and mitigation services at no cost.

Send the notice to people directly. The European Data Protection Board says a notification "solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual."

4. Say only what you can prove

On July 16, 2020, the software vendor Blackbaud announced that the attacker "did not access donor bank account information or social security numbers." The SEC says that within days, company personnel learned the attacker had accessed and taken that information. In 2023 Blackbaud agreed to a $3 million SEC civil penalty over misleading disclosures, and later a $49.5 million settlement with 49 state attorneys general and the District of Columbia. The lesson for a small business is cheap to follow: nothing in your press statement should be broader or more reassuring than what you told regulators.

5. Publish one owned page

Put plain-language answers on your own site: what happened, what was involved, what you are doing, and how you will contact people in future. Say which channels you will never use, for example payment requests by text. Breach-themed phishing follows every public incident, and this line helps your customers spot it.

6. Plan for the review wave

Expect one-star reviews from affected customers and from people who only read the headline. Do not report a review just because you dislike it: Google says it only removes reviews that violate its policies. Reply to each real review with the same facts as your notice. Never buy, script or suppress reviews. The FTC's rule on fake reviews, 16 CFR Part 465, has applied since October 21, 2024, with a civil penalty ceiling of $53,088 per violation. We wrote up what Google, Yelp and Trustpilot will and will not remove in After the Breach Notice, the Reviews.

One-page version

1. Incident log opened, awareness time recorded.
2. Counsel confirms which clocks apply.
3. Notice drafted with the five headings, sent directly.
4. Public statement matches the notice, word for word in substance.
5. Owned page live.
6. Review replies drafted from the same facts.

We are DefendMyRep, a reputation and privacy defense firm. Every rule above is sourced in our longer, hour-by-hour guide, The First 72 Hours After a Data Breach Goes Public. To see what a stranger finds when they search your business name, you can request a free reputation audit report.