Within a reasonable time, not to exceed 45 days after you learn of the unauthorized acquisition. If a single incident requires notifying 1,000 or more people, you must also notify the nationwide consumer reporting agencies without unreasonable delay. Noncompliance can be used as evidence of negligence in a civil case.