Since January 1, 2026, California's breach law runs two separate clocks. A business must notify California residents within 30 calendar days of discovery or notification of the breach, and, if it notifies more than 500 California residents, send the Attorney General a sample copy within 15 calendar days of notifying consumers. Civil Code 1798.82 applies to any individual or business that conducts business in California and owns or licenses computerized data that includes personal information ((a)(1)). Before that date the statute set no day count for residents, so a summary written earlier will not show this deadline.
Does California's breach law apply to this incident?
It applies when four things are true: the person is a California resident, the data includes a listed element, the data was unencrypted (or encrypted, with the key also taken), and an unauthorized person acquired it or you reasonably believe so ((a)(1)). A breach is unauthorized acquisition that compromises the security, confidentiality or integrity of personal information; good-faith acquisition by an employee or agent for the business's purposes is excluded, provided the information "is not used or subject to further unauthorized disclosure" ((g)).
Which data counts. Personal information is a first name or first initial and last name plus one of these elements ((h)(1)):
- (A) Social Security number
- (B) driver's license, California ID, tax ID, passport, military ID or other government ID number
- (C) account number or credit or debit card number with any required code or password that would permit access to the financial account
- (D) medical information
- (E) health insurance information
- (F) unique biometric data (photographs are excluded unless used for facial recognition)
- (G) data collected by an automated license plate recognition system
- (H) genetic data
A username or email address plus a password, or a security question and answer, that would permit access to an online account is also personal information, with no name needed ((h)(2)).
Encryption. Encrypted data is outside the law unless the key or security credential was also acquired, or is reasonably believed to have been, and you reasonably believe it could make the data readable or usable ((a)(1)).
Ransomware without proven exfiltration. Neither the statute nor Attorney General materials we found address this. Our analysis, not law: because "reasonably believed to have been acquired" does not require proof, an attacker with hands on a database of listed elements can meet it even without an exfiltration log. Check with counsel before treating "no proof of exfiltration" as "no breach." The test is acquisition, not access; licensed health facilities have an access test, below.
When must residents be notified?
Notice is due within 30 calendar days of "discovery or notification of the data breach" ((a)(2)(A)). "Notification" most naturally covers a heads-up from a vendor (our reading), so a vendor's call can start your clock.
The 30 calendar days are "subject to" a delay provision, which allows two grounds for delay ((a)(2)(B)):
- Law enforcement. If an agency determines notice will impede a criminal investigation, notice may be delayed and must go "promptly after" the agency determines it will not compromise the investigation ((c)). The statute sets no cap and does not require the agency's determination to be in writing. Get it in writing.
- Scope and integrity. You may delay "as necessary to determine the scope of the breach and restore the reasonable integrity of the data system" ((a)(2)(B)). The statute states no limit and does not define "necessary," and how far this stretches is, in our reading, unsettled. It is a ground you must be able to defend, not extra investigation time built into the 30 days. Record, for each day beyond day 30, what scoping or restoration work made it necessary.
The letter must say whether notice was delayed for a law enforcement investigation, if that can be determined when notice goes out ((d)(2)(D)). Day counting (whether the discovery day counts, how weekends are treated) is not set out in 1798.82, and we could not verify California's general computation rules. Check with counsel how days are counted.
What does the Attorney General get, and when?
If you notify more than 500 California residents as a result of a single breach, you must electronically submit one sample copy of the notice, excluding personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers ((f)). The Attorney General's online form offers "500 or More Individuals" as a choice; the statute's "more than 500" governs.
- The clock starts at the consumer notice, not at discovery. If letters go out in waves, the statute does not say whether "notifying" means the first or the last mailing. Our analysis: count from the first mailing, and confirm with counsel.
- Cite the statute, not the Attorney General's reporting page. As of November 2, 2026, that page states the sample-copy duty without the deadline. Use the online submission form, which takes a PDF and asks for discovery dates, consumer notice dates and the number of Californians affected.
The letter will be public. The form states that a copy of the notification "will be made publicly available online," and the Attorney General's breach list links the posted samples. Our view: write the letter assuming customers, plaintiffs' lawyers and reporters will read it, and remove personal information before upload.
How do the two clocks fall on a calendar?
A fictional example in calendar days, counting day 1 as the day after discovery, with dates that land on weekdays.
Event | Date | Rule |
|---|---|---|
Discovery (logged with evidence) | Mon, March 2, 2026 | (a)(2)(A) |
Resident notice due, absent a delay ground | Wed, April 1, 2026 | 30 calendar days |
First letters mailed | Wed, March 25, 2026 | before the deadline |
Attorney General sample copy due (more than 500 residents) | Thu, April 9, 2026 | 15 calendar days from mailing, (f) |
Mailing early pulls the Attorney General date forward too. Confirm the counting method with counsel before relying on these dates.
What must the letter say?
Plain language, the title "Notice of Data Breach," five fixed headings, conspicuous display and 10-point type or larger ((d)(1)). For a written notice, using the statute's model form is deemed compliance ((d)(1)(D)). The required elements are in the checklist at the end.
What changed on January 1, 2026?
SB 446 (Hurtado) was approved October 3, 2025 and chaptered as Stats. 2025, ch. 319; it took effect January 1, 2026 and amended only 1798.82.
- Residents. Before: disclosure "in the most expedient time possible and without unreasonable delay." Now: within 30 calendar days of discovery or notification, with the two delay grounds above.
- Attorney General. Before: a sample copy with no deadline. Now: within 15 calendar days of notifying consumers.
- Letter headings. The first two headings now end in question marks.
- Unchanged in substance. The element list, encryption clause, HIPAA clause, substitute-notice values, type size and the identity theft offer.
The agency version, 1798.29, was not amended: state agencies still have no fixed day count.
What changes for vendors, HIPAA entities and substitute notice?
Maintainers. A business that maintains data it does not own must notify the owner or licensee "immediately following discovery" if the data was, or is reasonably believed to have been, acquired ((b)). Put that duty into your vendor incident notification clauses; your own 30 days may start when the vendor tells you.
HIPAA. A covered entity that fully complies with the HITECH notice rules is deemed to comply with the content requirements in subdivision (d), and nothing exempts it from other provisions ((e)). Our reading: the 30-day clock, the Attorney General copy and the delivery methods still apply.
Substitute notice (email, a website posting for at least 30 days, and statewide media) is allowed only if cost exceeds $250,000, the class exceeds 500,000, or you lack contact information ((j)). If the breach involves login credentials for an email account you furnished, do not send the notice to that email address ((j)(5)).
What else applies in California?
- Licensed health facilities. Clinics, health facilities, home health agencies and hospices licensed under Health and Safety Code 1204, 1250, 1725 or 1745 must report unauthorized access to, or use or disclosure of, medical information to the Department of Public Health and the patient no later than 15 business days after detection (H&S 1280.15). Access alone triggers it, and the department may assess a penalty of $100 for each day a report is late; separately, it may assess administrative penalties per patient for the unauthorized access itself, under a combined cap per reported event ((a), (d)). We read the 2025 text; check for later amendments.
- DFPI licensees. The Department of Financial Protection and Innovation "encourages" licensees to report a reportable cyber incident within 48 hours or as soon as possible (DFPI). It is a request, not a legal deadline; keep it off the statutory calendar.
- Private suits. Section 1798.150 creates a private right of action after certain breaches; litigation is outside this page.
What to do in order
- Hour 0, incident lead: log the discovery date, the evidence and who decided. Verify: a dated entry exists.
- Day 1, privacy lead with counsel: decide the four tests (resident, element, encryption, acquisition) and estimate California residents. Verify: a written count with a confidence level.
- Day 1, calendar owner: enter day 30, and ask counsel how days are counted. Verify: the date is in the incident calendar.
- Days 1 to 10, counsel: ask any law enforcement agency whether it wants notice delayed, in writing; open a delay log. Verify: the request letter or the log exists.
- By day 20, privacy lead: draft the letter to the checklist below and prepare the PDF sample without personal information. Verify: counsel sign-off.
- By day 30, privacy lead: mail the letters and record the mailing date. Verify: dated proof of mailing.
- Within 15 days of mailing, privacy lead: upload the sample to the Attorney General's form if more than 500 California residents were notified. Verify: the confirmation. Then add both deadlines to your incident response plan.
An AI agent can help with steps 1 and 2: pulling log timestamps for the evidence entry and counting California addresses in an affected-data export. A human decides the discovery date and any delay.
California checklist (copy into a ticket)
- [ ] Discovery date and evidence logged ((a)(2)(A))
- [ ] Four tests decided: resident, element ((h)), encryption and key ((a)(1)), acquisition
- [ ] Day 30 on the calendar; counting method confirmed with counsel
- [ ] Delay ground, if any: law enforcement agency's determination ((c)) with your written record of it, or scope log ((a)(2)(B))
- [ ] Letter title "Notice of Data Breach" and, in this order, the headings "What Happened?", "What Information Was Involved?", "What We Are Doing", "What You Can Do" and "For More Information" ((d)(1)); 10-point type or larger; plain language
- [ ] Letter has: your name and contact details; types of personal information involved; the notice date; and, where they can be determined at the time of notice, the breach date, estimated date or range, whether law enforcement delayed notice, and a general description ((d)(2)(A)-(E))
- [ ] If SSN, driver's license or California ID number exposed: toll-free numbers and addresses of the major credit reporting agencies ((d)(2)(F))
- [ ] If you were the source of the breach and it exposed or may have exposed an SSN or a government ID number listed in (h)(1)(B): an offer of appropriate identity theft prevention and mitigation services at no cost for at least 12 months (the statute adds "if any"; ask counsel how to read it) ((d)(2)(G))
- [ ] Delivery method meets (j); substitute notice only if its conditions are met
- [ ] Mailing date recorded; Attorney General date set 15 calendar days later ((f))
- [ ] PDF sample without personal information uploaded to the Attorney General form if more than 500 California residents
