A national breach notification law needs to be simple and limited, officials said, but stopped short of endorsing a specific proposal.