When a breach is confirmed, notifications must be sent without unreasonable delay and no later than 60 days from the discovery of the breach. The notification must include a description of the breach, the types of information involved, the steps affected individuals should take to protect themselves, what the organization is doing to investigate the breach, and contact information for further inquiries.
