Breach notification

Breach notification is the process of informing affected people, regulators, or other required parties when certain personal information may have been accessed, acquired, or exposed without authorization. The exact trigger, timing, content, and recipients depend on the applicable laws and the type of information involved. In multifamily operations, this can include resident, applicant, employee, contractor, or supplier-related data.

A property management company discovers that an unauthorized person accessed a resident portal containing usernames, passwords, and applicant records. The incident response team works with counsel to determine which state laws apply, whether affected residents must be notified, whether regulators must be contacted, and whether any supplier contract requires additional coordination.

Breach notification matters because multifamily firms hold large amounts of sensitive data and may face different obligations across states and regulators. Late, incomplete, or poorly coordinated notices can increase legal, regulatory, operational, and reputational risk. Clear incident response plans, escalation paths, and supplier notification requirements help leaders respond faster and reduce confusion during an incident.