Only four states still don’t have data breach reporting laws
It looks like only four US states stilll don't have laws that require businesses to notify victims of a data breach. The four that don't are Alabama, Kentucky, New Mexico and South Dakota. I must have lost track of the various state laws over the past few years. The last that I remember, more states than that didn't have such laws.