Data breach notifiation laws appy to (1) applicability of organization, (2) notification requirements with regard to parties who must be notified that the breach occurred, (3) notification timing requirements, and (4) specific penalties that may be incurred for failure to comply.