Form of notice Notice may be provided in writing (such as on paper and sent by mail), in electronic form (such as by e-mail, but only in very limited circumstances), or by substitute notice (such as by publication in statewide newspapers and on the company's website).

When it comes to notifying individuals, the nature of the triggering event is of tantamount importance. In several states, for example, notification is required whenever there has been an unauthorized acquisition of covered electronic personal data. In other states, however, unauthorized acquisition of such data does not trigger the notification requirement unless there is a reasonable likelihood of harm to the individuals whose personal information is involved.

Taken as a group, these security breach notification laws suggest a key new addition to the law on corporate information security obligations—one that goes well beyond the duty of a company to provide security for its information, by adding a duty to warn those who might be adversely impacted by a failure— or a lack—of corporate security.

Implicit in both the laws imposing a duty to provide security and those imposing a duty to notify individuals of breaches is recognition of the wide-ranging impact of a company's electronic activities, and the fact that security vulnerabilities in a company can have a significant adverse affect on a wide variety of stakeholders.