[...]

Strategies for compliance

• Identify systems containing personal information and enhance mechanisms to detect unauthorized conduct on networks. Because breach notification statutes are triggered when personal information is compromised, organizations should identify the systems on which such data is stored and enhance the means used, such as logging capabilities, to detect when a breach has occurred.
  
• Encrypt personal information. The majority of the state statutes only require notification if a breach compromises unencrypted personal information. Organizations that encrypt personal information will not only better protect consumers but also avoid onerous notification obligations.
  
• Amend incident response plan to require that key decision-makers are immediately alerted when breaches are detected. Because the statutes are likely triggered as soon as an intrusion has been detected by the IT department, organizations should ensure that incident response plans provide for timely reporting of incidents to those responsible for making notification decisions.
  
• Adopt a corporate incident response policy that provides for notification. As noted, the statutes are modeled on California's law and generally provide more flexibility when 'a person or business maintains its own notification procedures as part of an information security policy for the treatment of personal information.' Companies now have significant incentive to develop their own form of incident response plans.
  
• Ensure that third-party contracts involving the transfer of personal data include appropriate information security provisions. Breach notification laws provide no exception for when data within the possession of a third-party is compromised. Organizations should ensure that their contracts contain provisions requiring that vendors or subcontractors provide immediate notification of suspected breaches, and allowing the organization both to participate in the investigation of incidents and exercise control over decisions regarding external reporting.