What should a small business do after a data breach?

Ascent Vision · Published October 28, 2026

Secure your systems without destroying evidence, find out what was exposed, and tell the people who need to know. The FTC's guide puts securing operations first, fixing weaknesses next, then notifying law enforcement, affected businesses and individuals. Under Florida's statute, notice to affected individuals is generally due within 30 days of determining a breach or having reason to believe one occurred, and notice to the state when a breach affects 500 or more people in Florida. This is a plain summary, not legal advice.

The FTC's order of response

The FTC's guide is the agency's general guidance, and says answers vary from case to case. Its order, by its headings:

Secure your operations. Take affected equipment offline right away, but do not turn machines off until forensic experts arrive, and talk to legal counsel. The related answer on a hacked website covers passwords and keeping evidence.
Fix vulnerabilities. Check what service providers can access and verify their fixes. Work out what was exposed and who is affected. Plan your message: nothing misleading, and no key details withheld that could help people protect themselves.
Notify appropriate parties. Determine your legal requirements and call local police right away. Tell any institution that maintains accounts whose numbers were stolen from you, any business whose data you hold, and contact the major credit bureaus if Social Security numbers were stolen. Then notify affected individuals, checking the timing with your law enforcement contact. (The Florida summary below ties a delay to the agency's written request.)

Florida's notice rule, in summary

Section 501.171 of the Florida Statutes (2026) applies to a "covered entity", such as a sole proprietorship, partnership or corporation that acquires, maintains, stores or uses personal information. A breach is unauthorized access of data in electronic form containing personal information. Good-faith access by an employee or agent is not a breach if the information is not used for a purpose unrelated to the business or subject to further unauthorized use. Personal information includes a first name or initial and last name together with an item such as a Social Security number, a driver license or other government ID number, a financial account or card number together with any required access code, or medical information. Separately, it includes a user name or email address together with a password or security question and answer that would permit access to an online account. It does not include information that a government entity made public, or information that is encrypted or otherwise made unusable. The statute requires reasonable measures to protect that data. Its notice rules include:

Individuals in Florida whose information was, or is reasonably believed to have been, accessed: "as expeditiously as practicable" and no later than 30 days after the determination of a breach or reason to believe one occurred, unless delayed or waived as below.
The Department of Legal Affairs, for a breach affecting 500 or more individuals in Florida, as expeditiously as practicable and no later than 30 days after the determination of the breach or reason to believe one occurred. A covered entity may receive 15 additional days to give the individual notice (not the department notice) if it gives the department good cause for delay in writing within those 30 days.
Nationwide consumer reporting agencies, without unreasonable delay, if the entity discovers circumstances requiring notice of more than 1,000 individuals at a single time; the notice covers the timing, distribution and content of the notices.
Delay: individual notice is delayed on a law enforcement agency's written request if the agency determines it would interfere with a criminal investigation, for the period it specifies.
Exception: individual notice is not required if, after an appropriate investigation and consultation with relevant law enforcement agencies, the entity reasonably determines the breach has not and will not likely result in identity theft or any other financial harm to the individuals affected. The determination must be documented in writing, kept at least 5 years and given to the department within 30 days after it is made. Because it rests on the entity's own judgment, ask an attorney before relying on it.
Vendors: a third-party agent contracted to maintain, store or process the data for you must tell you as expeditiously as practicable and no later than 10 days after determining a breach of a system it maintains, or having reason to believe one occurred; you then give the notices the section requires. An agent may give notice for you, but its failure to give proper notice is treated as your violation.

What this does not cover

The FTC's guide is agency guidance, not a statute, and it says to check state and federal laws for the requirements that apply to your business. Other states' laws can also apply, and the FTC's guide points to the FTC Health Breach Notification Rule and the HIPAA Breach Notification Rule for breaches involving health records; this summary does not cover them. Whether Florida's statute applies to a particular incident is a question for an attorney.

The related answers on a hacked website and a hacked business email account cover the first hours, and the one on backing up your data covers recovery. This is a plain summary, not legal advice.

Sources

Ongoing technical support

The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.

See the service Work with us