In 1748, in response to the request of a friend, Benjamin Franklin offered the following hints in his pamphlet, Advice to a Young Tradesman, Written by an Old One: “Remember that time is money. Remember that credit is money.” In a patchwork landscape of data breach notification laws, these words have never been so true for American companies preparing for and responding to data breaches.

According to the Identity Theft Resource Center, 92 million records were exposed from 619 data breaches in 2013; 84 percent of which emanated from the business sector. It is no surprise then that the United States spent more than any other country on notification costs following a breach of identity-type data. That's $565,020 per incident. The threat is real and may be lying dormant: 66 percent of all data breaches took months or even years to discover, according to the 2013 Verizon Data Breach Investigation Report.

State laws regarding data breach notifications answer the “W's and H” of journalism — the who, what, when and how — but answer them in dizzyingly different ways. I'll take up each question in turn, cutting straight through the amorphousness of these laws to arrive at what you need to know to protect your company's assets today.