If your business or agency holds personal information about California residents and that information is exposed in a security breach, California law requires you to notify every affected person within 30 calendar days of discovering the breach. That hard deadline took effect January 1, 2026 under SB 446, replacing the older standard of notifying people “in the most expedient time possible.”1California Legislative Information. California Civil Code 1798.82 – Customer Records The California data breach notification requirements also dictate what the notice must say, how it can be delivered, when the Attorney General has to be told, and what it costs when a business ignores the rules.
Who Has to Send a Notice
Civil Code Section 1798.82 applies to any individual or business that does business in California and owns or licenses computerized data containing personal information.1California Legislative Information. California Civil Code 1798.82 – Customer Records The obligation covers data you hold, not just data you collected. If you maintain personal information on behalf of another organization, you must notify that data owner immediately after discovery so the owner can handle consumer notification.
One important carve-out: notification is not required when the compromised data was encrypted and the encryption key was not also taken. If both the encrypted data and the key were acquired, the obligation applies as though the data had been in plain text.
What Data Triggers the Rules
Not every security incident counts. The statute protects specific categories of sensitive data. “Personal information” means an individual’s name (or first initial and last name) combined with at least one of the following unencrypted elements:2California Legislative Information. California Civil Code 1798.81.5
- A government-issued identifier such as a Social Security number, driver’s license or California ID number, tax ID, passport number, or military ID
- A financial account, credit card, or debit card number paired with any security code, access code, or password that would unlock the account
- Medical records, health insurance information, or genetic data
- Biometric data used to authenticate identity, such as fingerprints, retina or iris scans (an ordinary photo does not count unless stored for facial recognition)
A separate category qualifies on its own, without a name attached: a username or email address combined with a password or security question answer that would grant access to an online account.2California Legislative Information. California Civil Code 1798.81.5 Information already publicly available through government records is excluded.
The 30-Day Deadline and Its Exceptions
As of January 1, 2026, notice to affected individuals must go out within 30 calendar days of discovering or being notified of the breach.1California Legislative Information. California Civil Code 1798.82 – Customer Records SB 446, signed on October 3, 2025, replaced the earlier open-ended timing standard with this concrete number.3California Legislative Information. SB 446 – Data Breaches: Customer Notification – Bill Status
Two situations justify going past 30 days. Law enforcement can request a delay when notification would interfere with a criminal investigation; once the agency releases the hold, the business must notify promptly. The second allowance covers the time genuinely needed to determine the scope of the breach and restore the integrity of the affected system. That second exception is not open-ended. The clock starts at discovery, and regulators will look closely at how any extra time was actually used.
What the Notice Must Include
The notice must be written in plain language, titled “Notice of Data Breach,” and organized under five specific headings:1California Legislative Information. California Civil Code 1798.82 – Customer Records
- What Happened — a general description of the breach, including the date or estimated date range
- What Information Was Involved — the specific types of personal information compromised, named precisely rather than described vaguely
- What We Are Doing — steps taken to address the breach and prevent recurrence
- What You Can Do — recommended protective measures for affected individuals
- For More Information — the entity’s name and contact details for follow-up questions
Text must be at least 10-point type, and the headings must appear conspicuously.
Credit Reporting and Identity Theft Services
When the breach exposed a Social Security number, driver’s license number, or California ID card number, the notice must also list the toll-free numbers and mailing addresses of the major credit reporting agencies so affected people can place a fraud alert.
When the entity that suffered the breach is also the source of the compromised data and the breach involved sensitive identifiers like Social Security numbers, that entity must offer free identity theft prevention and mitigation services for at least 12 months, and the notice must explain how to enroll.1California Legislative Information. California Civil Code 1798.82 – Customer Records
When the Attorney General Has to Be Notified
If a single breach affects more than 500 California residents, the entity must also submit a sample copy of the notice to the California Attorney General through the AG’s online portal, with any personally identifying information about affected individuals stripped out.4Office of the Attorney General. Data Security Breach Reporting SB 446 added a deadline for this submission: 15 calendar days after the entity notifies affected consumers.5California Legislative Information. SB 446 – Data Breaches: Customer Notification
The AG’s office publishes these submissions, so they often become the public reference point for how an incident was handled.
How the Notice Can Be Delivered
The default options are written notice sent by first-class mail to the last known address, or electronic notice if the entity already uses electronic communication with the recipient or the recipient has expressly consented to electronic delivery.1California Legislative Information. California Civil Code 1798.82 – Customer Records Consent for electronic legal notices is governed by the federal E-SIGN Act and requires more than simply having someone’s email on file.6National Credit Union Administration. Electronic Signatures in Global and National Commerce Act (E-Sign Act)
Substitute Notice
Substitute notice is available only when one of three conditions is met: individual notice would cost more than $250,000, the affected group exceeds 500,000 people, or the entity lacks sufficient contact information. When one of those applies, the entity must do all three of the following:7California Legislative Information. California Civil Code 1798.82 – Customer Records
- Email the notice to every affected person for whom an email address is on file
- Post the notice conspicuously on the entity’s homepage or first significant page for at least 30 days, using larger, contrasting, or otherwise visually distinct text
- Notify major statewide media outlets
Substitute notice is a fallback. The entity has to be able to show that one of the qualifying conditions actually exists.
Penalties and Lawsuits for Noncompliance
Enforcement comes from two directions. The Attorney General can seek injunctive relief against a business that violates the notification rules, and affected individuals can bring civil actions for damages under Civil Code Section 1798.84.8California Legislative Information. California Civil Code 1798.84 Past AG settlements have reached seven and eight figures when companies concealed or delayed breach disclosures.9Office of the Attorney General. Privacy Enforcement Actions
Separately, the California Consumer Privacy Act gives consumers a direct right to sue when a breach results from a business’s failure to maintain reasonable security practices. Statutory damages run from $100 to $750 per consumer per incident, or actual damages, whichever is greater.10California Legislative Information. California Civil Code 1798.150 Those per-person numbers add up quickly in class actions. Courts consider the seriousness of the misconduct, the number of violations, and the business’s financial condition in setting the amount.
Before suing for statutory damages, a consumer must send the business a written notice identifying the violations and allow 30 days to cure. If the business actually fixes the problem and provides a written statement that no further violations will occur, statutory damages are off the table for that incident. The statute is explicit, however, that implementing better security after a breach does not cure the breach itself.10California Legislative Information. California Civil Code 1798.150 Consumers seeking only actual out-of-pocket damages do not have to send the 30-day notice.
Government Agencies Follow a Parallel Statute
State and local government agencies in California are not covered by Section 1798.82. They operate under Civil Code Section 1798.29, which mirrors the private-sector rules with minor differences.11California Legislative Information. California Civil Code 1798.29 Agencies must notify affected residents, breaches affecting more than 500 Californians still trigger AG reporting, and an agency using substitute notice must also notify the Office of Information Security within the Department of Technology in addition to statewide media.