Title 38, Veterans' BenefitsRelease 119-110

§5726 Reports and Notice to Congress on Data Breaches

Title 38 › PART IV — GENERAL ADMINISTRATIVE PROVISIONS › CHAPTER 57 — RECORDS AND INVESTIGATIONS › SUBCHAPTER III — INFORMATION SECURITY › § 5726

Last updated Sep 22, 2026|Official source

Summary

The Secretary must send a report to the House and Senate Veterans’ Affairs Committees for any data breach of sensitive personal information that happened in a fiscal quarter. The report is due within 30 days after the quarter ends. For each breach, the report must say which part of the Department and which facility handled the data and what fix or corrective steps have been taken. If a breach is judged to be significant, the Secretary must promptly tell those Veterans’ Affairs Committees. If the breached data is about a member of the Army, Navy, Air Force, Marine Corps, or a Department of Defense civilian, the Secretary must also notify the House and Senate Armed Services Committees. Notice must come quickly after the breach is found and after steps are taken to determine its size, stop more leaks, and restore the data system.

Full Legal Text

Title 38, §5726

Veterans' Benefits, Source: USLM XML via OLRC

(a)Quarterly Reports.—

(1)Not later than 30 days after the last day of a fiscal quarter, the Secretary shall submit to the Committees on Veterans’ Affairs of the Senate and House of Representatives a report on any data breach with respect to sensitive personal information processed or maintained by the Department that occurred during that quarter.

(2)Each report submitted under paragraph (1) shall identify, for each data breach covered by the report—

(A)the Administration and facility of the Department responsible for processing or maintaining the sensitive personal information involved in the data breach; and

(B)the status of any remedial or corrective action with respect to the data breach.

(b)Notification of Significant Data Breaches.—

(1)In the event of a data breach with respect to sensitive personal information processed or maintained by the Secretary that the Secretary determines is significant, the Secretary shall provide notice of such breach to the Committees on Veterans’ Affairs of the Senate and House of Representatives.

(2)In the event of a data breach with respect to sensitive personal information processed or maintained by the Secretary that is the sensitive personal information of a member of the Army, Navy, Air Force, or Marine Corps or a civilian officer or employee of the Department of Defense that the Secretary determines is significant under paragraph (1), the Secretary shall provide the notice required under paragraph (1) to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives in addition to the Committees on Veterans’ Affairs of the Senate and House of Representatives.

(3)Notice under paragraphs (1) and (2) shall be provided promptly following the discovery of such a data breach and the implementation of any measures necessary to determine the scope of the breach, prevent any further breach or unauthorized disclosures, and reasonably restore the integrity of the data system.

Reference

Citations & Metadata

Citation

38 U.S.C. § 5726

Title 38, Veterans' Benefits

Last Updated

Sep 22, 2026

Release point: 119-110