Breach notification laws by state don't share a single deadline or trigger definition. Here's why that timing gap still catches policyholders off guard.