The California Customer Records Act, codified at Civil Code sections 1798.80 through 1798.84, requires any business that handles a California resident’s personal information to keep that data reasonably secure, dispose of records properly when they are no longer needed, and notify affected residents after a data breach. It has been on the books since 2003 and reaches far more businesses than the better-known California Consumer Privacy Act, because it has no revenue or data-volume threshold.
Who Has to Follow the Act
The Act applies to any individual or business that conducts business in California and owns or licenses computerized data containing personal information about California residents.1California Legislative Information. California Civil Code CIV 1798.82 The security obligation in Section 1798.81.5 reaches businesses that own, license, or maintain such information. “Own” and “license” cover information retained in an internal customer account or used in transactions with the person it relates to; “maintain” covers information a business holds but does not own, such as data stored on behalf of a client.2California Legislative Information. California Civil Code CIV 1798.81.5
There is no minimum size. A five-person company that keeps customer names and credit card numbers on file is subject to the same obligations as a multinational. The only real limits are geographic and relational: the business must conduct business in California, and the data must belong to California residents.
What Counts as Personal Information
The Act uses two definitions of personal information, and the one that applies depends on which obligation is at issue.
For the security requirements and breach notification rules, personal information means a person’s first name or first initial and last name combined with at least one of the following unencrypted data elements:2California Legislative Information. California Civil Code CIV 1798.81.5
- Social Security number
- Driver’s license or California ID card number
- Financial account number combined with a security code, access code, or password that would allow access to the account
- Medical information
- Health insurance information
A username or email address combined with a password or security question and answer that would permit access to an online account also qualifies. Publicly available information lawfully accessible from government records is excluded.
The broader definition in Section 1798.80(e) describes personal information as any information that identifies, relates to, describes, or can be associated with a particular individual. That wider definition applies to the record disposal requirement in Section 1798.81, which is why disposal duties cover a larger universe of records than breach notification does.
The Security Obligation
Section 1798.81.5 is the core security rule. A business that owns, licenses, or maintains personal information about a California resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information.2California Legislative Information. California Civil Code CIV 1798.81.5 The statute does not prescribe specific technologies. What counts as reasonable depends on the sensitivity of the data, the size of the business, and the tools available.
The obligation extends beyond a company’s own walls. When a business shares personal information with a third party under a contract, it must require that third party to implement and maintain reasonable security measures of its own. Vendor contracts need data security clauses; outsourcing data handling does not shed the protection duty.
Disposing of Records
When customer records containing personal information are no longer needed, Section 1798.81 requires disposal by shredding, erasing, or otherwise making the personal information unreadable or undecipherable.3California Legislative Information. California Civil Code 1798.81 The statute does not spell out separate methods for paper versus electronic records, but the practical application is simple: shred paper, and either wipe or physically destroy electronic media.
This rule catches more than people expect. Old filing cabinets full of customer applications, retired hard drives sitting in a closet, backup tapes from a decommissioned system — all fall under the disposal rule once the business no longer needs them. The most common compliance failure is simply forgetting the data still exists.
Breach Notification
The breach rules in Section 1798.82 are the most detailed part of the Act. A business that owns or licenses computerized data containing personal information must notify any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.1California Legislative Information. California Civil Code CIV 1798.82
Notification must happen within 30 calendar days of discovering or being notified of the breach. A business may delay only in two narrow situations: when law enforcement determines that notification would impede a criminal investigation, or when additional time is needed to determine the scope of the breach and restore system integrity. Once either justification ends, the notice must go out promptly.
A business that merely maintains personal information it does not own, such as a cloud hosting provider storing another company’s customer data, has a different duty. It must notify the owner or licensee of the data immediately after discovering the breach, rather than notifying consumers directly.
What the Notice Must Say
The statute prescribes a specific format. The notice must be written in plain language, titled “Notice of Data Breach,” and organized under five mandatory headings: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.” The text must be at least 10-point type, and the headings must be clearly and conspicuously displayed.
At a minimum, the notice must include the name and contact information of the reporting business, a list of the types of personal information involved, the date or estimated date range of the breach if known, whether notification was delayed due to a law enforcement investigation, and a general description of the incident.4California Legislative Information. California Code Civil Code 1798.82 The business may optionally describe what steps it has taken to protect affected individuals.
How the Notice Is Delivered
Businesses can deliver breach notices by written mail or by electronic notice consistent with the federal E-Sign Act. When direct notice is impractical, the law allows substitute notice. Substitute notice is permitted if the cost of direct notice would exceed $250,000, the affected group is larger than 500,000 people, or the business lacks sufficient contact information. It requires all three of the following: email to anyone whose address the business has, a conspicuous posting on the business’s website for at least 30 days, and notification to major statewide media outlets.
If a single breach forces notification to more than 500 California residents, the business must also submit a sample copy of the notification to the California Attorney General, with personally identifiable information removed.5State of California – Department of Justice – Office of the Attorney General. Data Security Breach Reporting
Encryption Is Not a Complete Shield
Encryption helps, but it is not absolute. A breach of encrypted data does not trigger notification obligations so long as the encryption key or security credential was not also acquired, or reasonably believed to have been acquired, by the unauthorized person. If both the encrypted data and the key were compromised, the safe harbor disappears and the full notification obligation applies.
The statute defines “encrypted” as data rendered unusable, unreadable, or undecipherable to an unauthorized person through a security technology or methodology generally accepted in the information security field. Outdated encryption that no longer meets current industry standards would not qualify.
Penalties and the Right to Sue
The Act gives consumers a private right of action. Under Section 1798.84, any customer injured by a violation can file a civil lawsuit for damages directly, without waiting for a government agency to act.6California Legislative Information. California Civil Code CIV 1798.84
For violations of Section 1798.83, which governs disclosure of customer information shared with third parties for marketing purposes, the statute sets specific civil penalty amounts. A customer can recover up to $3,000 per violation if the violation was willful, intentional, or reckless, or up to $500 per violation otherwise. Prevailing plaintiffs can also recover attorney’s fees and costs.
Courts can issue injunctions against any business that violates or proposes to violate the Act. Any contractual provision that attempts to waive a customer’s rights under the Act is void and unenforceable. The remedies are cumulative with any other remedies available under law, so a plaintiff can pursue claims under this Act and other applicable statutes at the same time.
How This Compares to the CCPA
The Customer Records Act and the California Consumer Privacy Act live in the same title of the Civil Code and both deal with personal information, but they do different work.
The Customer Records Act focuses on data security, record disposal, and breach notification, and applies to any business handling California residents’ personal data with no size threshold. The CCPA governs how businesses collect, use, share, and sell personal information, and applies only to for-profit entities that meet at least one of three thresholds: annual gross revenue over $26,625,000, buying or selling data on 100,000 or more consumers, or deriving 50 percent or more of annual revenue from selling or sharing personal information.7California Privacy Protection Agency. Does My Business Need To Comply With The CCPA
A small business that falls below every CCPA threshold still has obligations under the Customer Records Act if it keeps customer records with personal information. Compliance with one law does not automatically satisfy the other.
Federal Law Does Not Replace These Rules
Businesses in regulated industries sometimes assume federal compliance excuses them from state obligations. For California data security requirements, that assumption is mostly wrong.
The Gramm-Leach-Bliley Act, which governs financial institutions, does not preempt state laws that provide greater consumer protection. Under 15 U.S.C. § 6807, a state law is not considered inconsistent with GLBA if it affords individuals greater protection than the federal standard. Because the Customer Records Act imposes breach notification deadlines, specific notice formats, and disposal requirements that go beyond GLBA, financial institutions generally must comply with both.
Healthcare entities face the same dynamic with HIPAA. The federal privacy rule sets a floor, not a ceiling. A state law that provides greater privacy protections or greater individual rights than HIPAA is not preempted.8U.S. Department of Health & Human Services (HHS.gov). Preemption of State Law California’s 30-day notice deadline, the prescribed notice format, and the disposal rules add obligations that HIPAA does not impose on its own, so covered entities handling California residents’ health data need to satisfy both frameworks.
Treat federal compliance as a baseline. The California-specific pieces, particularly the 30-day notification deadline, the mandatory notice format, and the record disposal rules, sit on top of whatever federal law requires.