1. Home
  2. State breach laws
  3. California

California data breach notification law

What California requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Cal. Civ. Code § 1798.82 (businesses) and § 1798.29 (state agencies); § 1798.82 amended by SB 446 (Stats. 2025, Ch. 319).

30 days
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

California is where a breach turns into a lawsuit fastest. Since January 2026 the notification clock is a firm 30 days, the Attorney General gets a sample notice within 15 days of consumer notice once more than 500 residents are involved, and the AG posts filings in a searchable public database. Injured customers can sue under the breach law itself, and a separate privacy law, the CCPA, adds statutory damages of $107 to $799 per consumer when a breach results from a failure to maintain reasonable security. A California organization on that list is weighing litigation exposure, not just cleanup, and that is the moment to bring incident readiness, evidence preservation, and managed detection to the table.

See recent California breach filings →

Requirements in detail

Statute
Cal. Civ. Code § 1798.82 (businesses) and § 1798.29 (state agencies); § 1798.82 amended by SB 446 (Stats. 2025, Ch. 319)
Deadline to notify residents
Within 30 calendar days after discovering or being notified of the breach. The deadline can be extended for the legitimate needs of law enforcement, or as needed to determine the scope of the breach and restore the reasonable integrity of the data system.
Attorney General notification
Yes, if more than 500 California residents are notified because of a single breach. A sample copy of the notice must be submitted electronically to the Attorney General within 15 calendar days after notifying affected consumers. The statute does not require notice to consumer reporting agencies.
Penalties
Any customer injured by a violation can sue to recover damages, and a business that violates the law can be enjoined. The breach notification statute does not set a per-violation civil penalty. A separate law, the California Consumer Privacy Act (§ 1798.150), lets consumers recover between $107 and $799 per consumer per incident, or actual damages if greater, when a breach results from a failure to maintain reasonable security.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
California's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. California has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
SB 446 (Stats. 2025, Ch. 319), effective January 1, 2026, added a firm deadline of 30 calendar days to notify residents and required the sample notice to go to the Attorney General within 15 calendar days after consumers are notified.

California breach notification FAQ

What is the data breach notification deadline in California?

Within 30 calendar days after discovering or being notified of the breach. The deadline can be extended for the legitimate needs of law enforcement, or as needed to determine the scope of the breach and restore the reasonable integrity of the data system. The governing law is Cal. Civ. Code § 1798.82 (businesses) and § 1798.29 (state agencies); § 1798.82 amended by SB 446 (Stats. 2025, Ch. 319).

Does California require notifying the Attorney General of a data breach?

Yes, if more than 500 California residents are notified because of a single breach. A sample copy of the notice must be submitted electronically to the Attorney General within 15 calendar days after notifying affected consumers. The statute does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in California?

Any customer injured by a violation can sue to recover damages, and a business that violates the law can be enjoined. The breach notification statute does not set a per-violation civil penalty. A separate law, the California Consumer Privacy Act (§ 1798.150), lets consumers recover between $107 and $799 per consumer per incident, or actual damages if greater, when a breach results from a failure to maintain reasonable security.

Can individuals sue over a data breach in California?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in California?

California's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does California limit breach lawsuits for companies with a cybersecurity program?

No. California has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the California Attorney General before relying on them.

Other states with a 30-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →