The District of Columbia rule in full No fixed deadline
D.C. Code §§ 28-3851 to 28-3853
- Notify residents
- In the most expedient time possible and without unreasonable delay. The business may allow for law enforcement needs and steps to determine the scope of the breach and restore the system.
- Notify the state
- Give written notice to the Office of the Attorney General if the breach affects 50 or more District residents. It is due promptly and no later than when residents are notified. Not knowing the number of affected residents does not delay this notice.
- Credit bureaus
- More than 1,000 residents notified.
- No-harm exception
- An acquisition is not a breach if the business reasonably determines it will likely not result in harm to the individual. This requires a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement agencies.
- Encryption
- Encrypted or redacted data is exempt unless the information acquired could compromise the security protection, such as a key.
- Data covered beyond the basic set
- Taxpayer ID, passport number, military ID, medical information, genetic data, health insurance information, biometric data, online account credentials.
- Enforcement
- A violation is an unfair or deceptive trade practice under the D.C. Consumer Protection Procedures Act. In an AG action, the AG shall recover a civil penalty of $500 to $5,000 per violation, or $1,000 to $10,000 per repeat violation. Consumers may recover actual damages.
- Recent change
- D.C. Law 26-187, the Enhancing Consumer Protection Procedures Amendment Act of 2026 (effective September 26, 2026), made AG civil penalties for breach violations mandatory, with $500 and $1,000 minimums, and moved them to § 28-3904(b)(14). Its rewrite of § 28-3905 applies only once funded in an approved budget.
- Also know
- If Social Security or taxpayer ID numbers are released, the business must offer free identity theft protection for at least 18 months (§ 28-3852.02). The AG notice must include set details, such as the number of residents affected and a sample of the notice. A vendor that maintains data must notify the owner in the most expedient time possible after discovery. The law also requires reasonable security (§ 28-3852.01). Credentials that give access to an email account count.
Law: D.C. Code §§ 28-3851 to 28-3853 | § 28-3851(1)(B)(iii) | § 28-3853(b). Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: Maryland, Virginia. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe DC data breach notification law brings in the Attorney General at 50 residents
The District's breach law, D.C. Code sections 28-3851 to 28-3853, requires Attorney General notice once a breach affects 50 District residents 1. Most states that use a count set it at 500 or 1,000. Notice to residents is due in the most expedient time possible and without unreasonable delay, with time allowed for law enforcement needs, finding the scope of the breach and restoring the system 1.
The Attorney General notice is due promptly and no later than resident notice. Not knowing how many residents were affected does not delay it 1. It must include set details, such as the number of District residents affected and a sample of the resident notice.
If Social Security or taxpayer ID numbers were released, the business must offer free identity theft protection for at least 18 months 9. The law also requires reasonable security for the personal information you keep 1.
Covered data and the no-harm rule
DC's definition is broad. On top of the standard elements it covers taxpayer ID, passport and military ID numbers, medical, genetic, health insurance and biometric data, and credentials that open an online account, including an email account 2. A phished Microsoft 365 mailbox can be a reportable breach here.
An acquisition is not a breach if the business reasonably determines it will likely not cause harm. That decision needs a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement agencies 2. In DC the no-harm route still involves the regulator.
Encrypted or redacted data is exempt unless the information acquired could compromise the protection, such as a key 2.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessPenalties after D.C. Law 26-187
A violation is an unfair or deceptive trade practice under the D.C. Consumer Protection Procedures Act 3. Since September 26, 2026, when D.C. Law 26-187 took effect, civil penalties in an Attorney General action are mandatory: $500 to $5,000 per violation, or $1,000 to $10,000 per repeat violation 5.
Consumers may also recover actual damages for a breach law violation 4. The same 2026 law rewrites the section that provides that remedy, but the rewrite applies only once it is funded in an approved budget, so the current text still governs 5.
When a District business is breached
With the incident still running, an insured District organization contacts its carrier ahead of everyone else, reports to the FBI's IC3 at ic3.gov, and does not wipe or rebuild anything until the evidence is captured 7108. A policy naming panel counsel expects that call before any firm is retained; conditions carriers attach has more.
Then hand containment to your IT support firm or a specialist breach response team, and split the affected list by home jurisdiction. Many District employers have staff living in Maryland and Virginia, whose laws protect their own residents; each state's rule is in our comparison table. IC3 recorded 3,113 complaints from the District in 2025, with about $97 million lost 6. Our Washington, DC managed IT guide covers what ongoing support costs in the District.
We compared this summary with D.C. Code sections 28-3851 to 28-3853 on October 13, 2026. It does not stand in for legal advice; if you are weighing the no-harm route, have counsel handle the consultation with the Office of the Attorney General.
Common questions
Does the DC data breach notification law set a deadline?
Not in days. Residents must hear in the most expedient time possible and without unreasonable delay 1.
When do you have to notify the DC Attorney General?
When a breach affects 50 or more District residents. Written notice is due promptly and no later than resident notice, and not knowing the exact count does not delay it 1.
What are the penalties for a DC breach law violation?
Does DC require identity theft protection after a breach?
Yes, if Social Security or taxpayer ID numbers were released. The business must offer free identity theft protection for at least 18 months 9.
Can a DC business decide a breach is harmless and skip notice?
Only after a reasonable investigation and consultation with the Office of the Attorney General and federal law enforcement agencies 2. If the business then reasonably determines harm is unlikely, the event is not a breach under the law.
Sources
- Council of the District of Columbia, D.C. Code, D.C. Code §§ 28-3851 to 28-3853 (§ 28-3852), 2026.
- Council of the District of Columbia, D.C. Code, § 28-3851 Definitions, 2026.
- Council of the District of Columbia, D.C. Code, § 28-3853 Enforcement, 2026.
- Council of the District of Columbia, D.C. Code, § 28-3905, 2026.
- Council of the District of Columbia, D.C. Law 26-187 (Enhancing Consumer Protection Procedures Amendment Act of 2026), 2026-09-26.
- FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report (States by Complaint Count, p.28; States by Complaint Loss, p.29), 2026-04.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- FBI, Ransomware, 2026-04-08.
- Council of the District of Columbia, D.C. Law 23-98 (Security Breach Protection Amendment Act of 2019), 2020.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.