Reference · updated July 2026

Data breach notification laws, by jurisdiction

All 54 US jurisdictions, compiled from primary statutes and reflecting the 2026 amendments in California (SB 446) and Oklahoma (SB 626). Each entry links to a full breakdown; every fact is dated and cites its code section.

22 jurisdictions with a hard numeric deadline

Jurisdiction	Individual deadline	AG notice	Risk-of-harm trigger	Statute
California	30 days	Yes	No, any breach	Cal. Civ. Code §1798.82
Colorado	30 days	Yes	No, any breach	Colo. Rev. Stat. §6-1-716
Florida	30 days	Yes	No, any breach	Fla. Stat. §501.171
Maine	30 days	Yes	Qualified	10 M.R.S. §1346 et seq.
New York	30 days	Yes	No, any breach	N.Y. Gen. Bus. Law §899-aa
Washington	30 days	Yes	No, any breach	Wash. Rev. Code §19.255.010 et seq.
Alabama	45 days	Yes	Yes	Ala. Code §8-38-1 et seq.
Arizona	45 days	Yes	Yes	Ariz. Rev. Stat. §18-551 et seq.
Indiana	45 days	Yes	Yes	Ind. Code §24-4.9
Maryland	45 days	Yes	Yes	Md. Code, Com. Law §14-3501 et seq.
New Mexico	45 days	Yes	Yes	N.M. Stat. §§57-12C-1–12
Ohio	45 days	No	Yes	Ohio Rev. Code §§1349.19–192
Oregon	45 days	Yes	Yes	Or. Rev. Stat. §§646A.600–628
Rhode Island	45 days	Yes	Yes	R.I. Gen. Laws §§11-49.3-1–6
Tennessee	45 days	No	No, any breach	Tenn. Code §§47-18-2105–2107
Vermont	45 days	Yes	Yes	9 V.S.A. §§2430, 2435
Wisconsin	45 days	No	No, any breach	Wis. Stat. §134.98
Connecticut	60 days	Yes	Qualified	Conn. Gen. Stat. §36a-701b
Delaware	60 days	Yes	Yes	Del. Code tit. 6 §12B-101 et seq.
Louisiana	60 days	Yes	Yes	La. Rev. Stat. §51:3071 et seq.
South Dakota	60 days	Yes	Yes	SDCL §§22-40-19–26
Texas	60 days	Yes	No, any breach	Tex. Bus. & Com. Code §§521.002, 521.053

32 jurisdictions on a "without unreasonable delay" standard

Jurisdiction	AG notice	Risk-of-harm trigger	Statute
Alaska	No	Yes	Alaska Stat. §45.48.010 et seq.
Arkansas	Arkansas Attorney General	Yes	Ark. Code §4-110-101 et seq.
District of Columbia	DC Attorney General	No, any breach	D.C. Code §28-3851 et seq.
Georgia	No	No, any breach	Ga. Code §10-1-910 et seq.
Guam	No	No, any breach	9 Guam Code §§48.10–48.80
Hawaii	Hawaii Office of Consumer Protection	Yes	Haw. Rev. Stat. §487N-1 et seq.
Idaho	No	Yes	Idaho Code §28-51-104 et seq.
Illinois	Illinois Attorney General	No, any breach	815 ILCS 530/5 et seq.
Iowa	Iowa Attorney General	Yes	Iowa Code §715C.1 et seq.
Kansas	No	Yes	Kan. Stat. §50-7a01 et seq.
Kentucky	No	No, any breach	Ky. Rev. Stat. §365.732
Massachusetts	Massachusetts Attorney General	No, any breach	Mass. Gen. Laws ch. 93H
Michigan	No	No, any breach	Mich. Comp. Laws §§445.63, 445.72
Minnesota	No	No, any breach	Minn. Stat. §325E.61
Mississippi	No	Yes	Miss. Code §75-24-29
Missouri	Missouri Attorney General	Yes	Mo. Rev. Stat. §407.1500
Montana	Montana Attorney General	Qualified	Mont. Code §§30-14-1701–1704
Nebraska	Nebraska Attorney General	Yes	Neb. Rev. Stat. §87-801 et seq.
Nevada	No	No, any breach	Nev. Rev. Stat. §603A.010 et seq.
New Hampshire	New Hampshire Attorney General	Yes	N.H. Rev. Stat. §§359-C:19–21
New Jersey	NJ Division of State Police	Yes	N.J. Stat. §56:8-161 et seq.
North Carolina	North Carolina Attorney General	No, any breach	N.C. Gen. Stat. §§75-61, 75-65
North Dakota	North Dakota Attorney General	No, any breach	N.D. Cent. Code §§51-30-01–07
Oklahoma	Oklahoma Attorney General	Yes	Okla. Stat. tit. 24 §§161–166
Pennsylvania	No	No, any breach	73 Pa. Stat. §2301 et seq.
Puerto Rico	PR Dept. of Consumer Affairs	No, any breach	P.R. Laws tit. 10 §4051 et seq.
South Carolina	SC Dept. of Consumer Affairs	No, any breach	S.C. Code §39-1-90
U.S. Virgin Islands	No	No, any breach	V.I. Code tit. 14 §2208 et seq.
Utah	Utah Attorney General + Utah Cyber Center	Yes	Utah Code §13-44-101 et seq.
Virginia	Virginia Attorney General	Yes	Va. Code §18.2-186.6
West Virginia	No	Yes	W. Va. Code §46A-2A-101 et seq.
Wyoming	No	Yes	Wyo. Stat. §§40-12-501, 502

Don't read 54 charts. Enter your incident once.

Run the deadline calculator →