Data breach notification laws by state
Every US state and DC requires breach notification — but deadlines, penalties, and enforcement vary dramatically. Use this reference to understand your obligations across jurisdictions.
30 days45 days60 daysNo fixed deadline
🗺
Select a state
Click any state on the map to see its breach notification requirements, deadlines, and penalties.
6
Jurisdictions with a 30-day deadline
11
Jurisdictions with a 45-day deadline
5
Jurisdictions with a 60-day deadline
29
No fixed deadline
All 50 states + DC
| State | Deadline | AG notification | Penalties | Private action | Liability protection |
|---|---|---|---|---|---|
| Alabama | 45 days | Yes, if more than 1,000 Alabama residents must be notified. … | A violation is an unlawful trade practice under the Alabama … | No | None |
| Alaska | No fixed | No, not for breaches that are reported to residents. The Att… | For businesses, a violation is an unfair or deceptive practi… | Limited | None |
| Arizona | 45 days | Yes, if more than 1,000 individuals must be notified. Within… | A knowing and willful violation is an unlawful practice that… | No | None |
| Arkansas | No fixed | Yes, if the breach affects more than 1,000 individuals. The … | Violations are enforced by the Attorney General under the Ar… | No | None |
| California | 30 days | Yes, if more than 500 California residents are notified beca… | Any customer injured by a violation can sue to recover damag… | Yes | None |
Showing 5 of 51 jurisdictions
Subscribe to see full penalties, AG thresholds, private action rights, and liability protections for every state and DC
Subscribe to unlockBreach notification law by state
Deadlines, Attorney General rules, penalties, and private right of action for each jurisdiction — free to read.
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
Track breaches with regulatory context built in
RiversideIQ links every breach event to the applicable state laws — deadlines, AG requirements, and penalty exposure in one view.
Subscribe to unlock