Organization should also consider encrypting customers' personal information in storage. In face, such encryption may be economically justified. A California law (SB 1386), for example, requires any business with customers in that state to personally notify every customer following a security incident involving access to the databases containing customer personal information. Moreover, the law applies to all California residents, even those who have addresses in other states. Thus, California SB 1386 effectively requires companies to notify all their customers whenever a security incident may have led to the compromise of personal identifiable information. This can be expensive for businesses with hundreds of thousands of customers. The law's costly notification requirement is waived, however, if the information was encrypted while in storage.