State data breach notification laws generally ________.

A) require entities that have suffered a data breach to conduct a secret data system audit

B) require entities that have suffered a data breach to confidentially notify the state auditor general

C) require entities that have suffered a data breach to notify customers or other affected parties of the security breach

D) apply only to private entities and not to governmental entities