What is the data breach notification deadline in California?

California requires notice to affected individuals 30 calendar days from discovery (Cal. Civ. Code §1798.82 (as amended by SB 446, eff. 1/1/2026)).

Do you have to notify the California Attorney General of a data breach?

Yes. California Attorney General must be notified.

← All jurisdictions

CA · data breach notification

California

high

Cal. Civ. Code §1798.82 (as amended by SB 446, eff. 1/1/2026) · read the statute →

Individual deadline

30 days

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	30 calendar days from discovery
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	California Attorney General, required above 500 residents; within 15 days Electronic submission of a sample copy of the consumer notice via OAG portal 15 calendar days AFTER consumer notification, not from discovery
Credit reporting agencies	No CRA-notice requirement.
Credit monitoring	Offer of identity-theft prevention/mitigation services, if any, must be ≥12 months at no cost (§1798.82(d)(2)(G))
Letter format	Prescribed format, Title 'Notice of Data Breach'; headings 'What Happened / What Information Was Involved / What We Are Doing / What You Can Do / For More Information'; plain language; ≥10-point type
Substitute notice	Available if cost exceeds $250,000 or more than 500,000 affected.
Private right of action	Yes.
Penalties	§1798.84 private action (civil penalty up to $3,000/violation willful); CCPA §1798.150 private right of action: statutory damages $100–$750 per consumer per incident; AG enforcement via UCL
Notable PI definitions	Includes biometric, credentials, medical, health insurance, tax id, passport, military id.

Notes

※ HIPAA/HITECH-compliant entities deemed compliant with notice-content rules (§1798.82(e))

※ Separate medical-information rule: Cal. H&S Code §1280.15 (15 business days, CDPH) — licensed clinics/health facilities only

Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a California breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →