---
kind: "section"
citation: "38 U.S.C. § 5726"
title: "38"
title_heading: "Veterans’ Benefits"
number: "5726"
heading: "Reports and notice to Congress on data breaches"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/38/5726"
units:
  - "Part IV — General Administrative Provisions"
  - "Chapter 57 — Records and Investigations"
  - "Subchapter III — Information Security"
---

# §5726. Reports and notice to Congress on data breaches

- (a) **Quarterly Reports.—**
  - (1) Not later than 30 days after the last day of a fiscal quarter, the [Secretary](/usc/38/101.md?p=1) shall submit to the Committees on [Veterans](/usc/38/101.md?p=2)’ Affairs of the Senate and House of Representatives a report on any [data breach](/usc/38/5727.md?p=4) with respect to [sensitive personal information](/usc/38/5727.md?p=19) processed or maintained by the [Department](/usc/38/101.md?p=1) that occurred during that quarter.
  - (2) Each report submitted under [paragraph (1)](#a-1) shall identify, for each [data breach](/usc/38/5727.md?p=4) covered by the report—
    - (A) the Administration and facility of the [Department](/usc/38/101.md?p=1) responsible for processing or maintaining the [sensitive personal information](/usc/38/5727.md?p=19) involved in the [data breach](/usc/38/5727.md?p=4); and
    - (B) the status of any remedial or corrective action with respect to the [data breach](/usc/38/5727.md?p=4).
- (b) **Notification of Significant Data Breaches.—**
  - (1) In the event of a [data breach](/usc/38/5727.md?p=4) with respect to [sensitive personal information](/usc/38/5727.md?p=19) processed or maintained by the [Secretary](/usc/38/101.md?p=1) that the [Secretary](/usc/38/101.md?p=1) determines is significant, the [Secretary](/usc/38/101.md?p=1) shall provide [notice](/usc/38/5100.md?p=2) of such breach to the Committees on [Veterans](/usc/38/101.md?p=2)’ Affairs of the Senate and House of Representatives.
  - (2) In the event of a [data breach](/usc/38/5727.md?p=4) with respect to [sensitive personal information](/usc/38/5727.md?p=19) processed or maintained by the [Secretary](/usc/38/101.md?p=1) that is the [sensitive personal information](/usc/38/5727.md?p=19) of a member of the Army, Navy, Air Force, or Marine Corps or a civilian officer or employee of the [Department](/usc/38/101.md?p=1) of Defense that the [Secretary](/usc/38/101.md?p=1) determines is significant under [paragraph (1)](#b-1), the [Secretary](/usc/38/101.md?p=1) shall provide the [notice](/usc/38/5100.md?p=2) required under [paragraph (1)](#b-1) to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives in addition to the Committees on [Veterans](/usc/38/101.md?p=2)’ Affairs of the Senate and House of Representatives.
  - (3) [Notice](/usc/38/5100.md?p=2) under paragraphs [(1)](#b-1) and [(2)](#b-2) shall be provided promptly following the discovery of such a [data breach](/usc/38/5727.md?p=4) and the implementation of any measures necessary to determine the scope of the breach, prevent any further breach or unauthorized disclosures, and reasonably restore the [integrity](/usc/38/5727.md?p=14) of the data system.

## Source credit

(Added Pub. L. 109–461, title IX, § 902(a), Dec. 22, 2006, 120 Stat. 3457.)