Why encryption is the question that matters most
Every U.S. state and the District of Columbia has a breach-notification law, and almost all of them attach the duty to unencrypted personal information, or to encrypted data when the key was exposed along with it. Federal rules follow the same logic. Under HIPAA, protected health information encrypted to HHS’s guidance is “secured” and its loss isn’t a breach of unsecured PHI. The FTC Safeguards Rule’s notice duty covers acquisition of unencrypted customer information, and treats data as unencrypted if the key was accessed. So the first job after a device goes missing is not to guess; it is to prove, for that serial number, that encryption was on and the key wasn’t with it. Your device-management console or key-escrow records are the evidence.
When encryption can’t be proven, the loss is treated as a possible breach, and clocks generally run from discovery: HIPAA’s outer limit for notifying individuals is 60 calendar days, the Safeguards Rule gives 30 days to notify the FTC when 500 or more consumers are involved, DFARS 252.204-7012 calls for reporting a cyber incident affecting covered defense information within 72 hours, and the GDPR gives 72 hours to notify the supervisory authority. State deadlines vary, and the states that matter are the ones where the affected people live. The Compliance Map lists each state’s breach-notification statute, and the ITAD breach case files show how these losses turn into enforcement.
Prevention is cheaper than triage
Most lost-device incidents trace back to a few controls: full-disk encryption enforced from deployment, devices recovered and verified by serial when people leave, and retired equipment destroyed on a schedule instead of waiting in a storeroom. The Offboarding Gap Diagnostic scores the departure side, and the cyber insurance coverage gap explains why a policy may not respond to a device that was never properly retired. Record every incident, even the ones that turn out not to be notifiable, in the Lost or Stolen Device Incident Log.
Sources: 45 CFR 164.400–164.414 (HIPAA Breach Notification Rule); 16 CFR 314.2(m) and 314.4(j) (FTC Safeguards Rule notification, effective May 13, 2024); DFARS 252.204-7012; GDPR Articles 33 and 34; SEC Form 8-K Item 1.05; each state’s breach-notification statute as cited in the Compliance Map. Current as of October 2026. This tool is a planning aid, not legal advice; notification decisions belong with your counsel.