1. Home
  2. State breach laws
  3. District of Columbia

District of Columbia data breach notification law

What District of Columbia requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by D.C. Code §§ 28-3851 to 28-3853.

No fixed deadline
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

District of Columbia sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent District of Columbia breach filings →

Requirements in detail

Statute
D.C. Code §§ 28-3851 to 28-3853
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering the breach, consistent with law enforcement needs and the steps needed to determine the scope of the breach and restore the system. There is no fixed number of days.
Attorney General notification
Yes, when 50 or more District residents are affected. Written notice must go to the Office of the Attorney General in the most expedient manner possible and no later than when residents are notified, and it may not be delayed because the total number of affected residents is not yet known. Nationwide consumer reporting agencies must be notified when more than 1,000 people are notified. Entities that follow HIPAA or Gramm-Leach-Bliley breach rules must still notify the Attorney General.
Penalties
A violation is an unfair or deceptive trade practice under the Consumer Protection Procedures Act. The Attorney General can recover civil penalties of $500 to $5,000 for each first violation and $1,000 to $10,000 for each repeat violation, plus economic damages, costs, and attorney's fees. Businesses must also offer at least 18 months of free identity theft protection when Social Security or taxpayer identification numbers are breached.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
District of Columbia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. District of Columbia has no law limiting breach lawsuits for organizations that maintain a security program.

District of Columbia breach notification FAQ

What is the data breach notification deadline in District of Columbia?

In the most expedient time possible and without unreasonable delay after discovering the breach, consistent with law enforcement needs and the steps needed to determine the scope of the breach and restore the system. There is no fixed number of days. The governing law is D.C. Code §§ 28-3851 to 28-3853.

Does District of Columbia require notifying the Attorney General of a data breach?

Yes, when 50 or more District residents are affected. Written notice must go to the Office of the Attorney General in the most expedient manner possible and no later than when residents are notified, and it may not be delayed because the total number of affected residents is not yet known. Nationwide consumer reporting agencies must be notified when more than 1,000 people are notified. Entities that follow HIPAA or Gramm-Leach-Bliley breach rules must still notify the Attorney General.

What are the penalties for failing to report a data breach in District of Columbia?

A violation is an unfair or deceptive trade practice under the Consumer Protection Procedures Act. The Attorney General can recover civil penalties of $500 to $5,000 for each first violation and $1,000 to $10,000 for each repeat violation, plus economic damages, costs, and attorney's fees. Businesses must also offer at least 18 months of free identity theft protection when Social Security or taxpayer identification numbers are breached.

Can individuals sue over a data breach in District of Columbia?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in District of Columbia?

District of Columbia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does District of Columbia limit breach lawsuits for companies with a cybersecurity program?

No. District of Columbia has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the District of Columbia Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →