What is the data breach notification deadline in District of Columbia?

District of Columbia requires notice to affected individuals in the most expedient time possible and without unreasonable delay (D.C. Code §28-3851 et seq.).

Do you have to notify the District of Columbia Attorney General of a data breach?

Yes. DC Attorney General must be notified.

← All jurisdictions

DC · data breach notification

District of Columbia

med

D.C. Code §28-3851 et seq.

Individual deadline

No fixed limit

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	in the most expedient time possible and without unreasonable delay
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	DC Attorney General, required at 50+ residents; in the most expedient manner possible Written notice to OAG-DC Statute-confirmed (D.C. Code §28-3852): required at ≥50 DC residents, no later than when residents are notified
Credit reporting agencies	Notify CRAs above 1,000 residents.
Credit monitoring	18 months of identity-theft protection when SSN/tax ID exposed
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	Yes.
Notable PI definitions	Includes biometric, credentials, medical, health insurance.

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a District of Columbia breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →