Data breach notification in California: what the law requires

Data breach notification in California is governed by Civil Code § 1798.82. Any business that owns or licenses personal information of California residents must notify affected residents within 30 calendar days of discovering the breach (effective January 1, 2026, under SB 446), and must send a sample notice to the Attorney General if more than 500 California residents are affected.

Where the law comes from

California's breach notification duty traces back to SB 1386 (2002), the first data breach notification law in the country, later codified at Cal. Civ. Code § 1798.82 (for businesses) and § 1798.29 (for state agencies). It has been amended repeatedly since — most recently to expand what counts as "personal information" and to add the California Attorney General reporting duty. It is a completely separate statute from the CCPA/CPRA and from the Delete Act (SB 362), even though all three sit in the same corner of California privacy law.

Who must notify

Civil Code § 1798.82 applies to "any person or business conducting business in California" that owns or licenses computerized data including personal information — not just companies headquartered in the state. If you have California customers, employees, or users in a database, the duty can reach you regardless of where you're incorporated. It also covers businesses that merely maintain data on behalf of another business: a processor that gets breached has to notify the data's owner "immediately following discovery," even though it isn't the one sending notice to consumers.

What counts as personal information

The statute's definition is narrower than the CCPA's. It's triggered by an individual's first name or initial plus last name, combined with one or more of:

• Social Security number
• Driver's license or California ID number
• Financial account, credit, or debit card number, together with any required security code or password
• Medical information or health insurance information
• Genetic data
• Unique biometric data (fingerprint, retina scan, etc.)
• A username or email address combined with a password or security question answer that would permit account access

Encrypted data generally falls outside the duty — the statute is about unauthorized acquisition of unencrypted personal information, or encrypted data where the encryption key was also compromised.

What triggers the notification duty

Notification is required once a business discovers, or is notified of, a breach of the security of the system resulting in unauthorized acquisition of unencrypted personal information. "Acquisition" is broader than "access" — an intruder who merely viewed data without confirmed copying may or may not trigger the duty depending on the facts, which is why breach counsel typically gets involved early to make that call.

Notification deadline

Since January 1, 2026, California sets a fixed deadline: notice to affected California residents must go out within 30 calendar days of discovering, or being notified of, the breach (SB 446, amending Civ. Code § 1798.82). Before that, the statute only said "in the most expedient time possible and without unreasonable delay." The existing carve-outs remain: delay is allowed for the legitimate needs of law enforcement, and for the time needed to determine the scope of the breach and restore the reasonable integrity of the system.

The Attorney General reporting threshold

The Attorney General publishes submitted sample notices on a public breach report page, which means a 500+ resident breach becomes a matter of public record — a meaningful reputational consideration on top of the legal one.

What the notice has to say

Section 1798.82 prescribes specific content: the name and contact information of the reporting entity, the categories of personal information breached, the date (or date range) of the breach, and a general description of the incident. Notices covering breach of login credentials must also tell the recipient to change their password and security questions, or take other steps to protect the affected account.

How this relates to CCPA and CPRA

Breach notification and consumer privacy compliance are governed by different statutes with different regulators, but they overlap in one important way: the CPRA gave California consumers a private right of action (Civ. Code § 1798.150) for breaches of certain unencrypted, nonencrypted personal information caused by a business's failure to maintain reasonable security procedures — on top of the AG notification duty above. A business already building out CCPA/CPRA compliance processes should treat breach-notification readiness as part of the same program, not a separate project, since the private-right-of-action exposure sits directly downstream of the same underlying security failure.

The data-broker connection

Every data broker holding a copy of your business's customer or employee records is another potential breach vector — and under Civil Code § 1798.82, a breach at a broker that maintains your data on your behalf still triggers a notification obligation for you as the data owner once the broker discloses it. California's Delete Act DROP program exists precisely to shrink that exposure: instead of sending an opt-out request to each of the 500+ brokers on the state registry individually, DROP lets you submit one deletion request that fans out broker-side. Fewer brokers holding your data means fewer places a breach can originate, and fewer parties who could trigger a notification duty on your behalf. See California Delete Act regulations and dates and SB 362, the Delete Act for how the deletion mechanics work.

FAQ

Who has to notify under California's data breach notification law?

Any person or business that conducts business in California and owns or licenses computerized data that includes personal information of California residents. A business that only maintains the data for someone else must notify the owner immediately following discovery.

What is the deadline for data breach notification in California?

Notice to affected California residents is due within 30 calendar days of discovering or being notified of the breach, for breaches discovered on or after January 1, 2026 (SB 446). Delay is allowed only for law enforcement needs or to determine scope and restore system integrity.

When do you have to notify the California Attorney General?

When more than 500 California residents must be notified of a single breach, the business must electronically submit a sample copy of the notice to the Attorney General. SB 446 adds a 15-calendar-day deadline for that submission.

Does encrypting data eliminate the notification duty?

Generally yes, unless the encryption key itself was also acquired in the breach — in which case the data is treated as if it were unencrypted.

Is there a minimum number of affected people before notification is required at all?

No. Individual notice to affected California residents is required regardless of headcount; the 500-resident threshold only triggers the additional Attorney General filing.

Does this law replace CCPA/CPRA breach obligations?

No — they're separate statutes that can both apply to the same incident. Breach notification is triggered by unauthorized acquisition of specific data elements; CCPA/CPRA governs broader data-handling and consumer-rights obligations, with its own private right of action for security failures.