What is the data breach notification deadline in Washington?

Washington requires notice to affected individuals 30 calendar days from discovery (Wash. Rev. Code §19.255.010 et seq.).

Do you have to notify the Washington Attorney General of a data breach?

Yes. Washington Attorney General must be notified.

← All jurisdictions

WA · data breach notification

Washington

high

Wash. Rev. Code §19.255.010 et seq.

Individual deadline

30 days

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	30 calendar days from discovery
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Washington Attorney General, required above 500 residents; within 30 days AG web form; single sample copy of consumer notice (PII excluded); duty to file updates
Credit reporting agencies	No CRA-notice requirement.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	Yes.
Notable PI definitions	Includes biometric, credentials, medical, health insurance, passport, military id, tax id.

Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Washington breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →