State Data Breach Notification Deadlines: All 50 States and DC, and What Changed

Here's a question that sounds like it should have a one-line answer: a company finds out on a Monday that someone copied its customer database. How long does it have to tell those customers?

The honest answer is "it depends where the customers live." The range runs from 30 days to no number at all. Same breach, same database, same Monday, and a completely different clock for every state the affected people call home.

I recently went through every state's breach notification law, plus DC's, against the statute itself rather than the summaries floating around (some of which were wrong). Here's what the deadlines actually look like.

Every state's clock

This is the deadline for notifying affected residents. Attorney General notice often runs on a different clock, which I'll come back to.

30 days (6): California, Colorado, Florida, Maine, New York, Washington

45 days (11): Alabama, Arizona, Indiana, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Tennessee, Vermont, Wisconsin

60 days (5): Connecticut, Delaware, Louisiana, South Dakota, Texas

No fixed number of days (29): Alaska, Arkansas, District of Columbia, Georgia, Hawaii, Idaho, Illinois, Iowa, Kansas, Kentucky, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, South Carolina, Utah, Virginia, West Virginia, Wyoming

A few footnotes, because there are always footnotes. Georgia's law only covers information brokers and state and local government agencies, not businesses in general. Pennsylvania gives public entities (state agencies, counties, schools, municipalities) 7 business days, even though private companies have no fixed number. Kentucky's public agencies get 35 days. And nearly every state lets law enforcement pause the clock if notice would get in the way of an investigation.

So 22 jurisdictions have a hard number and 29 don't. If you'd assumed most states had a deadline, you're in good company, and you're wrong.

"Without unreasonable delay" isn't a free pass

Most of the no-number states use some version of "in the most expedient time possible and without unreasonable delay." It's tempting to read that as "whenever you get around to it." It isn't.

What it really means is that nobody tells you the deadline in advance, and whoever enforces the law decides afterwards whether you were reasonable. That's arguably worse for a company that dawdles, because there's no number to point to and say "we were inside it." I'd rather have a 45-day clock I can plan around than a judgment call made by a regulator after the fact.

Same number, different starting line

Here's the part that trips people up even in the states that do have a number: they don't all start the clock at the same moment.

• Discovery. Most fixed-deadline states count from when the breach is discovered or the company is notified of it. New York, California, Washington, and Ohio all work this way.
• Determination. Texas counts 60 days from determining that a breach occurred. Colorado and Florida count their 30 days the same way (Florida also counts from when a business has reason to believe a breach occurred). Arizona counts 45 days from when the company's investigation determines a breach happened, and Alabama and Delaware also count from the determination.
• Something in between. Maine's 30 days run from when the business becomes aware of the breach and identifies its scope. Rhode Island's 45 days start once the breach is confirmed and the company can gather what the notice needs to say.

"Discovered" and "determined" can be weeks apart. A company that finds weird activity on day one and confirms data was actually taken on day 20 is on a very different schedule in New York than in Texas. (And yes, this is exactly the kind of thing that ends up argued about later.)

What changed recently

Breach laws don't change often, so when they do, it's worth paying attention. The recent ones:

• California (January 1, 2026). Until this year, California had no fixed deadline. SB 446 added a firm 30 calendar days, and the sample notice now has to reach the Attorney General within 15 days after consumers are notified (when more than 500 Californians are affected).
• New York (December 2024). New York set a hard 30-day deadline and, more importantly, removed the exception that let companies delay notice while they worked out the scope of the breach. The only thing that pauses the clock now is a law enforcement request. It also added the Department of Financial Services as a recipient for the companies it regulates.
• Pennsylvania (September 2024). No new deadline for private companies, but it added Attorney General notice when more than 500 residents are affected, and 12 months of free credit monitoring when Social Security numbers, bank account numbers, or driver's license numbers are involved.
• Oklahoma (January 1, 2026). Added Attorney General notice for breaches affecting 500 or more residents, and changed the trigger from discovering a breach to determining one occurred.
• Delaware (September 2, 2026). Tightened the rules around Attorney General notice, including when affected residents can't be identified within the 60 days.
• Vermont (coming January 1, 2027). Act 138 adds rules for phone notice and HIPAA-covered entities, and creates a separate breach notice law for data brokers.

And one to watch: Michigan's SB 360, which passed the state Senate in August 2025, would add a 45-day deadline and Attorney General notice at 100 residents. As of this month it's still sitting in a House committee, so it isn't law yet.

Notice the direction. Nobody is loosening the notification rules. California went from no number to 30 days. New York took away the scope exception. The trend is shorter clocks and more regulators in the loop.

The deadline that comes first

One more wrinkle, because the resident deadline isn't always the first one a company has to hit. Texas gives companies 60 days to notify Texans, but if 250 or more are affected, the Attorney General has to hear about it within 30 days of determining the breach occurred. The regulator finds out a full month before the people whose data it was have to.

What this means if you sell security services

Three practical things.

The law follows the resident, not the headquarters. A company based in a no-deadline state with customers in New York and California is on a 30-day clock for those customers. Most of your clients have customers, patients, or employees in more than one state, so the strictest state in their footprint sets the pace.

30 days is not much time. Detection, scoping, legal review, finding addresses, printing and mailing letters: all of it has to fit. Organizations that have never practiced this find out how long each step takes during the real thing. That's a concrete reason to talk about an incident response plan, and it's a better reason than "breaches are scary."

"When did you know?" becomes an expensive question. In discovery-based states, the clock can start before anyone has confirmed what was taken. Good logging and a documented timeline aren't just security hygiene; they're how a client proves it was on time.

If you want every state's full rules in one place, including Attorney General thresholds, penalties, and who can sue, they're on our state breach laws page, which is where RiversideIQ keeps track of all of this.

This post is a plain-English summary for security professionals, not legal advice. Breach laws have exceptions and details that matter, so anyone facing an actual breach should talk to a lawyer.