From the California Consumer Privacy Act to the Colorado Protections For Consumer Data Privacy law, each state now has its own requirements for organizations notifying individuals of a security breach. With 50 states, plus District of Columbia, Puerto Rico, Guam, and the Virgin Islands each having individual requirements – it can get complicated.