50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring entities to notify individuals of security breaches involving personally identifiable information.
The National Conference of State Legislatures assembled this very handy list.