Which entities must comply with breach notification requirements under FACT Act?

• A. Only banks and credit unions
• B. Any company with more than 100 employees
• C. Covered entities handling consumer information
• D. Only governmental agencies

Answer: (C)

The main idea is that breach notification requirements under the FACT Act apply to entities that handle or maintain consumer information. The goal is to alert individuals when their personal data is compromised, so they can take steps to protect themselves from identity theft. This duty isn’t limited to banks or to large companies, and it isn’t based on a employee headcount. It covers any covered entity that stores or uses consumer information, including service providers acting on their behalf. That broader scope is what makes the correct choice the best: entities handling consumer information must comply with breach notification. Government agencies aren’t the only ones subject to this, and the 100-employee threshold doesn’t establish who must comply.