New notification laws requiring companies to report data breaches to consumers are surging through state legislatures, adding a new compliance wrinkle for companies still struggling to satisfy the demands of Sarbox, the Health Insurance Portability and Accountability Act, and other regulations.