Under State breach notification laws, data controllers generally have primary responsibility for notifying data subjects of breaches involving their personal information. Usually, the statutes allow controllers to delay notice when requested by law enforcement, to determine the nature and scope of the breach, or other limited circumstances provided by statute. Subject to such delays, the following table summarizes the statutory deadlines or timing requirements to notify data subjects.