Scott suggested taking a deep breath. "Not every incident requires reporting," he noted. "Does the information meet the express definition of a particular state law? Does it constitute personal information under state law? Does it constitute nonpublic information under federal law? What you have may not be a notice-triggering incident. If the breach is contained and there are no victims, there is no need to report it under many statutes. Also, encryption is almost always a safe harbor.

"If the decision is made to notify, "The worst practice is to take the cheap route and communicate by e-mail," Ponemon added. "People will assume that you wanted the recipient to think it was spam and not open it. Actually, you want to make sure they read it, and use both a letter and a phone call to reach those who are at risk."

Pescatore noted that the recipients may not believe e-mail notification anyway, on the assumption that it's a phishing attempt. On the other hand, he added that the customers should be warned that they are likely to receive phishing e-mails pretending to be from the breached organization, offering to help them -- but needing personal information in order to do so.

"Among those who get the letter about 8 percent will be privacy-centric enough to change their behavior, and they can cause you a lot of grief by telling their friends and family, contacting their state attorney general and hiring a lawyer to sue you," Ponemon warned. "You can mitigate them by setting up a call center that offers answers that are factual and succinct. Don't just give a script to the call agents -- give out a toll-free number where people can reach someone with enough internal knowledge to get them to the right person."

Ponemon said that in cases where consumer data was breached, about 10 percent of the people who receive notification will call and ask questions, but the number can rise to 50 percent in cases where employee data is breached. If offered free credit monitoring services, about 30 percent will accept, he added, while many of those who decline apparently assume there is some catch to the free offer. Handing out coupons for goods and services will get a better response from them, Ponemon indicated, while the best practice is to give the recipients a choice, such as between monitoring, coupons or a credit on their bill. "But the company needs to decide early on how much support it is going to give, because the worse thing to do is to over-promise," Ponemon cautioned. "If you fail to live up to your commitments you can really hurt your reputation, and incite anger and lawsuits."