When an organization loses control of personal data, the law does not ask one question — it asks fifty-plus, in fifty-plus different voices. This UpLaw guide maps the entire data-breach notification regime: what counts as a "breach" (acquisition versus access), what counts as "personal information" under statutes that keep expanding, the risk-of-harm threshold and who gets to apply it, the encryption safe harbor that can make the whole problem disappear, the timing rules from "without unreasonable delay" to hard 30-day outer limits, the prescribed content and delivery of the notice itself, and the separate duties owed to attorneys general and the credit bureaus. It then layers on the sectoral overlays — the HIPAA Breach Notification Rule and its 60-day and 500-individual thresholds, the Gramm-Leach-Bliley Act and the FTC Safeguards Rule's new 30-day FTC reporting duty, the SEC's Item 1.05 Form 8-K materiality clock for public companies, and the GDPR's 72-hour supervisory-authority rule — plus the contractual notice promises that almost always bite before any statute does. Finally it walks the litigation that follows: negligence and the economic loss doctrine, implied contract, statutory claims including the CCPA's private right of action, and the Article III standing fight that TransUnion LLC v. Ramirez reshaped. A running hypothetical — Copperfield Retail, an intrusion touching customers in thirty states and the EU — carries the doctrine from the first alert to the last settlement.