Privacy Map

California. Breach notification. Act

CA breach lawCalifornia data breach notification law (Cal. Civ. Code §§ 1798.29, 1798.82)

In force

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about California residents to notify affected individuals after a security breach. Core timing rule: Individuals within 30 calendar days of discovery or notification (law-enforcement and scope/restoration delays allowed). Covered data: name plus SSN, government ID numbers, financial account with codes, medical and health insurance data, ALPR data, biometric and genetic data; online credentials alone.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

The first breach law (2003); prescribes 'Notice of Data Breach' title and headings in plain language; a source-of-breach entity must offer at least 12 months of free identity theft prevention where SSNs or ID numbers are exposed; CCPA adds a private right of action with statutory damages for breaches caused by unreasonable security.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: California requires the maintaining entity to notify the owner or licensee immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 30 calendar days of discovery or notification (law-enforcement and scope/restoration delays allowed); AG sample notice within 15 calendar days of individual notice if >500 residents
DPO
No
Cross-border transfers
None
Maximum penalty
Damages via customer civil action; CCPA § 1798.150 statutory damages $100-$750 per consumer per incident; AG/UCL penalties up to $2,500 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • SB 446 signed 2025-10-03, effective 2026-01-01, added 30-day individual deadline and 15-day AG deadline; earlier amendments 2014-2020 (AB 1130 added biometrics/passport, eff. 2020-01-01)

§4Text and authority

Text
Authority
California Attorney General (Department of Justice)

§5Where it applies

Domestic law of
California

§6Sources and verification

Sources consulted
Verification

High confidence.

SB 446 is enacted and in force from 2026-01-01.