All 50 U.S. states have data breach notification laws; the first was enacted 18 years ago in California. Pennsylvania's Breach of Personal Information Notification Act is more than 15 years old. And, ever since, data breach notices have been headlining newspapers (and appearing in recipients' mailboxes). A business leader would be hard-pressed to ignore that all U.S. states and most international jurisdictions have laws that trigger notification obligations in the wake of data security incidents.