When must a business notify individuals about a breach of sensitive information?

When a business experiences a breach of sensitive information, it is required to notify individuals immediately unless doing so would interfere with a criminal investigation. This requirement emphasizes the urgency of informing affected parties about potential risks to their personal information. Immediate notification helps individuals take necessary steps to protect themselves, such as monitoring their accounts or changing passwords, and it is a critical part of maintaining transparency and trust.

This approach recognizes that the protection of sensitive information is paramount and ensures that individuals are aware of any potential misuse of their data promptly. Delaying notification could lead to further harm, as individuals might remain unaware of the risks they face.

The other choices do not align with the best practices nor legal requirements for breach notifications. For instance, notifying individuals within 24 hours or one week could still leave them vulnerable if the situation is urgent. Similarly, notifying only when requested ignores the proactive responsibility businesses have to protect individuals' sensitive information.