The security policy a Illinois business is expected to have.

Every US state has a data-breach notification law. If personal information is exposed, the duty to notify is set by the law of the state where each affected individual lives — not only the state the business operates from — so a single incident can engage several states’ rules at once. Notification is generally required without unreasonable delay; many states set an outside limit of 30 to 60 days from discovery, though several set no fixed outer deadline and rely on the “without unreasonable delay” standard alone. “Discovery” is itself statutorily defined in most states and can be imputed — the clock frequently starts when the breach reasonably should have been known, not when someone actually noticed it. A number of states also require notice to the state attorney general once a threshold number of residents is affected. Establishing which laws apply is part of the assessment step in the business’s Incident Response Plan, taken with counsel where the answer is not obvious.

Harborview Accounting LLC operates from Illinois and treats Illinois’s breach-notification statute as its baseline, alongside the law of any other state where an affected individual lives. The specific statute, its deadlines, and its attorney-general reporting threshold are confirmed with counsel rather than assumed — this program records that the obligation exists and who is responsible for meeting it, not the text of the statute.