What happens if I miss the deadline?

The claim is normally barred and the court will dismiss it without reaching the merits. Narrow exceptions exist, principally tolling for minors or people lacking capacity and discovery rules where the injury was not reasonably discoverable, but they are exceptions rather than the norm.

Does the clock start at exposure or at diagnosis?

For most long-latency claims it starts at diagnosis, or at the point a reasonable person would have connected the harm to its cause. For claims where the injury is immediately obvious it generally starts at the event itself.

Can a deadline be paused?

Sometimes. Most states pause the period while the injured person is a minor or lacks legal capacity, and a pending class action can pause it for absent class members until certification is decided. Fraudulent concealment by a defendant can also toll it.

What is a statute of repose?

An absolute outer limit measured from a fixed event such as sale or implantation, rather than from injury or discovery. Where one applies it can bar a claim even if the injury was discovered later and the discovery rule would otherwise have helped.

Do I have to file suit by the deadline or just hire a lawyer?

The lawsuit itself must be filed with the court, or the required administrative claim submitted where one is a prerequisite. Contacting a lawyer does not stop the clock, and representation arranged close to a deadline may not leave enough time to prepare.

Data Breach Claim Deadlines: Two Clocks to Track

Which Clock Applies

State periods for negligence, contract and consumer protection claims apply, commonly two to four years and varying by which theory is pleaded.

Limitation periods are set by state law and differ between states, between claim types and sometimes between defendants. Nothing on this page substitutes for confirming the period that applies where your claim would be brought.

🚨

A missed deadline usually ends the claim outright

Limitation is jurisdictional rather than procedural. Once the period expires a court will normally dismiss regardless of how strong the evidence is, and defendants raise it as an early defence precisely because it avoids the merits entirely.

When the Clock Starts

The clock generally runs from the breach notification, since that is when the exposure became known, though some courts run it from the breach itself.

This is the fact most worth establishing early, because it is frequently more contested than whether the period has run. Fixing it to a document rather than to recollection is what makes the answer defensible.

The settlement claim deadline is the one most people miss

Where a settlement exists, the claim submission date in the notice is absolute. Missing it means receiving nothing while still being bound by the release, which is why claim rates in these settlements are so low.

Later misuse may start a fresh clock

If fraud occurs long after the breach, some courts treat the discovery of that misuse as the accrual date, which can revive a claim that looked time-barred.

Statutory claims have their own periods

Biometric and wiretapping statutes set their own limitation periods, which can be longer or shorter than the general tort period.

What to Do Now

Keep the breach notification letter. It fixes the date, identifies what was exposed, and is usually required to file a settlement claim.

This sits within our wider coverage of Data Breach Lawsuits, which sets out the shared background these cases have in common.

Before You Act

Thinking About Filing a Claim?

Most plaintiff lawyers offer a free initial consultation and work on contingency, meaning no fee unless there is a recovery. LawsuitWatch is not a law firm: we publish explainers, and we do not provide legal advice, representation or referrals. Your state bar directory is the reliable place to find and verify a lawyer.

Contact the Editorial Team Get Case Alerts