The Washington rule in full 30 days
RCW 19.255.005 to 19.255.040
- Notify residents
- In the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered.
- Notify the state
- Notify the Attorney General no more than 30 days after the breach was discovered, if a single breach requires notice to more than 500 Washington residents. Include the number affected, data types, exposure timeframe, containment summary and a sample notice, and update the AG if details were unknown at first.
- Credit bureaus
- Not required.
- No-harm exception
- Notice is not required if the breach is not reasonably likely to subject consumers to a risk of harm. The determination does not have to be documented.
- Encryption
- Secured data (encrypted to NIST standards or otherwise made unreadable) is exempt unless the key or other means to decipher it was also acquired.
- Data covered beyond the basic set
- Online account credentials, date of birth, digital signature, employer ID or student ID, military ID, passport number, health insurance information, medical information, biometric data.
- Enforcement
- The Attorney General may sue, and a violation is an unfair or deceptive act under the Consumer Protection Act (chapter 19.86 RCW).
- Also know
- Covered data elements count even without a name if they are not secured and would enable identity theft. A private key used to sign or authenticate an electronic record is covered. Businesses that process card payments can be liable to financial institutions for card-reissue costs after a breach (RCW 19.255.020). The AG posts notices publicly.
Law: RCW 19.255.005 to 19.255.040 | RCW 19.255.040(3)(a) | RCW 19.255.005. Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: Idaho, Oregon. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe Washington data breach notification law: 30 days and a wide data list
RCW 19.255.010 pairs one of the tightest fixed deadlines anywhere, 30 calendar days from discovery, with a long data list 1.
Past the usual name with an SSN, license number, or account or card number and code, the statute protects 2:
- Full date of birth
- Passport, military, student and employer ID numbers
- Medical information, health insurance information and biometric data
- Online account credentials
- The private key used to sign or authenticate an electronic record
Names are not required, either: an unsecured element that would enable identity theft by itself counts 12. A nameless list of birth dates and passport numbers can still trigger letters.
The 30-day clock and the Attorney General notice
Day one is discovery, not the end of the forensic work 1. For a small company that is a short runway: the investigation can eat most of it, and letters still need a mail house, call center scripts and a lawyer's review. Run the notice work in parallel from the first day.
If a single breach requires notice to more than 500 Washington residents, the Attorney General must be notified within the same 30 days 1. The AG notice must include:
- The number of Washington residents affected
- The types of personal information involved
- The time frame of exposure
- A summary of steps taken to contain the breach
- A sample copy of the notice sent to residents
Facts not yet known can follow in an update; file what you have on time 1. Expect the filing to become public, since the AG posts breach notices 1.
The credit bureaus get nothing under Washington law 1.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessExceptions: risk of harm and secured data
Letters are not needed when the breach is not reasonably likely to put consumers at risk of harm, and no written record of that call is required 1. With 30 days on the clock and lawsuits available, lean on it only with a forensic report and counsel's agreement.
Data that was secured is exempt. Secured means encrypted to NIST standards or otherwise made unreadable, and the exemption is lost if the key or other means to decipher the data was also acquired 12. Get written confirmation that laptop and backup encryption meets that bar; encrypted backup and recovery basics covers the backup side.
Lawsuits, penalties and card reissue costs
Washington gives injured consumers their own claim. Any consumer injured by a violation of the breach law may bring a civil action to recover damages 3. The Attorney General may also sue, and a violation is an unfair or deceptive act under the state Consumer Protection Act 1.
Retailers, restaurants and other card-accepting businesses face one more cost. A business that processes card payments can be liable to financial institutions for the cost of reissuing cards after a breach (RCW 19.255.020) 1. Payment security matters for that reason alone.
A 30-day plan for a Washington breach
Under attack with a cyber policy in force? The carrier's claim line is the first call, a complaint at ic3.gov the second, and nothing gets wiped until logs and disks are preserved 586. Washingtonians reported about $458 million in losses to IC3 in 2025 across 25,619 complaints 7.
On a 30-day clock, week one decides the outcome:
- Day 1: record the discovery date and have a containment team or the IT company you pay monthly stop the attack.
- Day 1 or 2: follow the policy's rules on counsel and forensics, explained in what cyber carriers require.
- Week 1: pin down the data and count people by state. Oregon and Idaho residents bring their own laws; our table of every state's deadline has the rest.
- Week 3: letters drafted, mail house booked, AG filing ready if past 500.
Washington also has a biometric identifier law that bars enrolling a biometric identifier in a database for a commercial purpose without notice, consent or a way to prevent later commercial use 4. Clinics have a federal layer in HIPAA's notice rule. IT support costs in Seattle, Tacoma and Spokane are on our city pages.
We read this summary against the RCW on October 13, 2026. Use it as background, not legal advice, and let a Washington lawyer confirm your duties.
Common questions
Washington data breach notification law: is it really 30 days?
Thirty calendar days from discovery at most, sooner where possible 1. Draft the letters while the investigation runs.
When does the Washington Attorney General need a breach notice?
When a single breach requires notice to more than 500 Washington residents. The notice is due within 30 days of discovery and must include the number affected, data types, exposure time frame, containment steps and a sample of the resident notice 1.
Can consumers sue over a data breach in Washington?
What counts as secured data in Washington?
Does Washington require notice to credit bureaus after a breach?
No 1. Only residents and, above 500, the Attorney General are notified.
What personal information does Washington's breach law cover?
Beyond the usual name with a Social Security, license or account number, it covers full date of birth, passport, military, student and employer IDs, medical and health insurance information, biometric data, online credentials and electronic signature keys 2. Some elements count even without a name 1.
Sources
- Washington State Legislature, RCW 19.255.005 to 19.255.040 (notice rule at RCW 19.255.010), 2020.
- Washington State Legislature, RCW 19.255.005 Definitions, 2020.
- Washington State Legislature, RCW 19.255.040, 2020.
- Washington State Legislature, RCW 19.375.020, 2017.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- FBI, Ransomware, 2026-04-08.
- FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report (States by Complaint Count, p.28; States by Complaint Loss, p.29), 2026-04.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.