Answer:
A business is required to notify individuals of a data breach if sensitive information such as a person's Social Security number, other government-issued ID numbers, financial account information, or protected health information are exposed. In many states, data such as email addresses and account passwords require notification, also.