Data breach notification laws typically require what?

• A. Require notification of affected individuals if sensitive personally identifiable information is stolen or lost
• B. Have caused companies to think more about security
• C. Both of the above
• D. Neither of the above

Answer: (C)

Breach notification laws establish a legal obligation to inform individuals when their sensitive personal data has been exposed, so people can take steps to protect themselves from potential misuse. At the same time, these laws create incentives for organizations to tighten security and improve incident response, since breaches bring legal duties, potential penalties, and reputational risk. Because both of these effects are true, the option that encompasses both is the best choice.