While California law applies to breaches by government agencies, as well as private individuals and businesses, some states have chosen to exclude state agencies, while others have limited the law to state agencies only, Mr. Reddick said.

Red flags for the property-casualty industry include definitional expansion of "personal information" beyond the California model that will make it more difficult for multistate insurers to comply, NAMIC said.

While most states don't set a specific deadline for compliance after a security breach, Florida has put a 45-day time limit and requires documentation be maintained for up to five years.

Nine states now require agencies or business to report breaches to consumer-reporting agencies, but the threshold that triggers that further notice varies. "When new bill introductions are proposed, the threshold should be as high as possible to avoid further exposures for insurers," Mr. Reddick said.

Meanwhile, Congress is considering legislation that would set federal rules for companies' consumer data security but would leave state regulators in charge of enforcing adherence by insurance companies.