What constitutes a reportable event under current cyber breach notification legal requirements for a SaaS company storing customer PII?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What constitutes a reportable event under current cyber breach notification legal requirements for a SaaS company storing customer PII?
5 real searches · 1 real-search pass
2026 US data breach notification laws SaaS personal information state laws FTC HIPAA GLBA SEC cybersecurity incident reporting current requirementsGoogle ↗
OBSERVEDConsequence
Indiana data breach notification law personal information 2026 Indiana Code 24-4.9 notification timing attorney generalGoogle ↗
OBSERVEDConsequence
FTC Safeguards Rule breach notification 500 consumers 30 days officialGoogle ↗
OBSERVEDConsequence
HHS HIPAA breach notification rule unsecured protected health information 60 days business associate officialGoogle ↗
OBSERVEDConsequence
SEC cybersecurity incident disclosure Form 8-K four business days material incident officialGoogle ↗
OBSERVEDConsequence
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
ChatGPT real searches (5)
Classes come from the query-classifier (a local Laya model). 4 of 5 calls are low-confidence (under 50%) — hover a query in the table to see its confidence.
Searches and sources
ChatGPT5 real searches · gpt-6
2026 US data breach notification laws SaaS personal information state laws FTC HIPAA GLBA SEC cybersecurity incident reporting current requirements Google ↗
Indiana data breach notification law personal information 2026 Indiana Code 24-4.9 notification timing attorney general Google ↗
FTC Safeguards Rule breach notification 500 consumers 30 days official Google ↗
HHS HIPAA breach notification rule unsecured protected health information 60 days business associate official Google ↗
SEC cybersecurity incident disclosure Form 8-K four business days material incident official Google ↗
- Data Breach Notification Laws: A 50-State Survey (2026 Edition) · privacyrights.org
- FTC Safeguards Rule: What Your Business Needs to Know · ftc.gov
- Breach Notification Rule · hhs.gov
- SEC.gov | Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure · sec.gov
- Data Breach Response: A Guide for Business · ftc.gov
- Attorney General: ID Theft Prevention: Security Breach FAQ's & Notification Form for Businesses · in.gov
- Indiana Code § 24-4.9-3-1. Disclosure of Breach :: 2025 Indiana Code :: U.S. Codes and Statutes :: U.S. Law :: Justia · law.justia.com
- Data Breach Notification Laws 2026 · privacyrights.org
- 42 U.S.C. § 17932: Notification in the case of breach · uscode.house.gov
- FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements: FBI Policy Directive Summary · fbi.gov
- Data breaches | Data protection guide for small business · edpb.europa.eu
- Personal data breaches · edpb.europa.eu
- 45. The GDPR does not provide an explicit time limit within which the processor must alert the controller, except that it must do so “without undue delay”. Therefore, the EDPB recommends the processor promptly notifies the controller, with further information about the breach provided in phases as more details become available. This is important in order to help the controller to meet the requirement of notification to the supervisory authority within 72 hours. · edpb.europa.eu
Queries
5 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
2026 US data breach notification laws SaaS personal information state laws FTC HIPAA GLBA SEC cybersecurity incident reporting current requirements OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 | |
Indiana data breach notification law personal information 2026 Indiana Code 24-4.9 notification timing attorney general OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 | |
FTC Safeguards Rule breach notification 500 consumers 30 days official OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 | |
HHS HIPAA breach notification rule unsecured protected health information 60 days business associate official OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 | |
SEC cybersecurity incident disclosure Form 8-K four business days material incident official OBSERVED | Google ↗ AI Mode ↗ | — | Consequence | — | — | 1x of 1 |