1. Home
  2. State breach laws
  3. Washington

Washington data breach notification law

What Washington requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Rev. Code Wash. §§ 19.255.005 to 19.255.040 (notice requirement at § 19.255.010).

30 days
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

With only 30 days to notify residents, Washington organizations are usually still mid-response when their filing becomes public, which is the point at which outside help is easiest to justify. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent Washington breach filings →

Requirements in detail

Statute
Rev. Code Wash. §§ 19.255.005 to 19.255.040 (notice requirement at § 19.255.010)
Deadline to notify residents
In the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered. Delay is allowed at law enforcement's request or for measures needed to determine the scope of the breach and restore the system.
Attorney General notification
Yes, within 30 days after the breach was discovered when more than 500 Washington residents must be notified because of a single breach. The notice must include the number of residents affected, the types of information involved, the exposure time frame, the containment steps taken, and a sample copy of the consumer notice, and it must be updated if any of this was unknown when it was due. The statute has no consumer reporting agency notice requirement.
Penalties
The Attorney General enforces the law under the Consumer Protection Act, where a violation is treated as an unfair or deceptive act, with civil penalties of up to $7,500 per violation. Injured consumers may also sue for damages, and violators may be enjoined.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
Washington's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Washington has no law limiting breach lawsuits for organizations that maintain a security program.

Washington breach notification FAQ

What is the data breach notification deadline in Washington?

In the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered. Delay is allowed at law enforcement's request or for measures needed to determine the scope of the breach and restore the system. The governing law is Rev. Code Wash. §§ 19.255.005 to 19.255.040 (notice requirement at § 19.255.010).

Does Washington require notifying the Attorney General of a data breach?

Yes, within 30 days after the breach was discovered when more than 500 Washington residents must be notified because of a single breach. The notice must include the number of residents affected, the types of information involved, the exposure time frame, the containment steps taken, and a sample copy of the consumer notice, and it must be updated if any of this was unknown when it was due. The statute has no consumer reporting agency notice requirement.

What are the penalties for failing to report a data breach in Washington?

The Attorney General enforces the law under the Consumer Protection Act, where a violation is treated as an unfair or deceptive act, with civil penalties of up to $7,500 per violation. Injured consumers may also sue for damages, and violators may be enjoined.

Can individuals sue over a data breach in Washington?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in Washington?

Washington's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Washington limit breach lawsuits for companies with a cybersecurity program?

No. Washington has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Washington Attorney General before relying on them.

Other states with a 30-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →