California Data Breach Notification Law

Why the California data breach notification law is stricter than most

California's data breach notification law, Civil Code section 1798.82, is tougher than most states' laws on three points ¹:

• A fixed 30-day deadline. Since January 1, 2026, residents must be notified within 30 calendar days of discovering or being notified of the breach ².
• No risk of harm exception. Many states let a business skip notice after deciding misuse is unlikely. California does not. If covered data was taken unencrypted, you notify.
• Customers can sue. Any customer injured by a violation may sue for damages, and a court can order a business to comply ³.

For contrast, every other state's notice rule sits in our comparison table.

The 30-day clock and the 15-day Attorney General notice

SB 446, signed October 3, 2025, set a hard limit: 30 calendar days from discovering the breach or being notified of it ². The bill states no effective date of its own, so it took effect on January 1, 2026, the default start date for a 2025 California statute.

The clock can pause in two situations. The business may delay for the legitimate needs of law enforcement, and as needed to determine the scope of the breach and restore the system ². Keep a dated record of any delay.

The Attorney General rule has its own deadline. When one breach requires notice to more than 500 California residents, submit a single sample copy of the resident notice, with no personal information in it, electronically within 15 calendar days of notifying consumers ². The submission goes through the Attorney General's online breach reporting form ⁴. That page did not mention the 15-day timing when we checked, so work from the statute.

Which data triggers notice in California

California covers more kinds of data than most states. Beyond the usual name plus Social Security number, driver's license number or financial account number with its code, the law reaches ¹²:

• Taxpayer ID, passport and military ID numbers
• Medical and health insurance information
• Biometric and genetic data
• Automated license plate recognition data
• Login credentials for an online account

That last item matters: a phished email or payroll login can be reportable even when no Social Security number was involved.

Encryption is the main exemption. Encrypted data is exempt unless the encryption key or security credential was taken, or is reasonably believed to have been taken, and the business reasonably believes it could make the data readable ². Turning on full-disk encryption costs little and turns a stolen laptop into a hardware loss rather than a mailing; basic protections for small offices walks through it.

What the notice must say and offer

A California notice must carry the title "Notice of Data Breach" ². If your business was the source of a breach that exposed Social Security numbers, driver's license numbers or California ID card numbers, you must offer identity theft prevention and mitigation services at no cost for at least 12 months ².

A cloud host or other vendor storing data for a California client owes that client a warning immediately after it discovers a breach ². Health facilities follow a separate 15 business day rule under Health and Safety Code section 1280.15, and HIPAA practices also have the federal HIPAA breach notification rule to meet.

Lawsuits, the CCPA and other exposure

California is one of the few states where customers can sue under the breach notification law itself, for damages caused by a violation ³. The California Consumer Privacy Act adds a second route: Civil Code section 1798.150 lets consumers sue for statutory damages over certain breaches caused by a failure to keep reasonable security.

The CCPA's wider duties apply only to for-profit businesses meeting one of three tests, such as annual gross revenue above $26,625,000 ⁵. Those tests belong to the CCPA, not the breach notification law, so a small office should not assume the breach rules skip it.

No state reports more cybercrime. IC3's 2025 report lists 116,414 complaints from Californians and about $3.67 billion in losses, first in the nation on both measures ⁶.

A 30-day plan for a California breach

While the attack is under way, an insured California company calls its carrier before anyone else, files an FBI complaint through ic3.gov, and keeps every affected system intact until forensic copies exist ⁷⁸⁹. Most policies with panel counsel expect that carrier call before any lawyer is engaged.

Then:

1. Contain the intrusion with your IT firm or a specialist; how breach response is divided up explains the roles, and the terms carriers attach to coverage covers the insurer's side.
2. Work out which data left and sort people by home state. A list with residents of Nevada or Oregon brings those states' rules in as well.
3. Put day 30 on the calendar from the date of discovery, and day 15 after mailing if more than 500 Californians are on the list.
4. Draft the notice with counsel and arrange identity theft services if the data calls for them.

Our local guides explain managed IT costs in Los Angeles, San Francisco, San Diego, San Jose, Sacramento, Orange County, Irvine, Long Beach, Oakland, Riverside, Fresno and Bakersfield.

Civil Code section 1798.82 was compared with this page on October 13, 2026. Take it as a plain-language overview rather than legal advice, and let California counsel confirm what you owe.