A Data-Breach-Notification<\/a> is a formal communication sent by an organization to individuals, regulatory authorities, and other stakeholders after a Security-Breach<\/a> results in the unauthorized access or disclosure of sensitive data. This process is a fundamental aspect of Cybersecurity<\/a> and Incident-Response<\/a> management. According to the General Data Protection Regulation<\/a> (GDPR), organizations operating within the European-Union<\/a> must notify the relevant supervisory authority within 72 hours of becoming aware of a breach that risks the rights of individuals.<\/p> In the United-States<\/a>, Data-Privacy<\/a> laws are largely sector-specific or state-mandated. For example, the Health-Insurance-Portability-and-Accountability-Act<\/a> (HIPAA) requires healthcare providers to notify patients and the Department-of-Health-and-Human-Services<\/a> when Protected-Health-Information<\/a> is compromised. Additionally, the Federal Trade Commission<\/a> (FTC) provides guidance for businesses on how to properly execute a Data-Breach-Notification<\/a> to mitigate harm and maintain Consumer-Trust<\/a>.<\/p> The contents of a notification typically include the date of the incident, the specific types of Personally-Identifiable-Information<\/a> involved, and the steps the organization is taking to secure its systems. Organizations may also implement Encryption<\/a> or Multi-Factor-Authentication<\/a> as remedial actions. To assist affected individuals, companies often provide Credit-Monitoring<\/a> services to prevent Identity-Theft<\/a>.<\/p>