Who may receive breach notification under the FACT Act?

• A. Only regulators
• B. Third-party marketers
• C. Affected individuals
• D. Affected individuals, and possibly regulators

Answer: (D)

When a breach involves consumer information, the rule is to alert those whose data was exposed. Affected individuals must receive notice so they can take steps to protect themselves, like reviewing credit reports or placing fraud alerts. In addition, regulators may also be notified in certain circumstances—such as when the breach is large or triggers specific reporting requirements set by law or enforcement policy. Third-party marketers aren’t the typical recipients of these notices, since they aren’t the victims of the breach. So the best answer reflects both groups that may receive notification: affected individuals, and possibly regulators.