Abstract
As data security breaches at colleges and universities continue to mount, government mandates for incident notification are emerging at the state level, and Congress is considering several proposals for a uniform, national law. Compliance is becoming increasingly complex due to the uncertainties associated with data-security incidents and the confusion associated with local, state, federal, and international requirements.