Privacy Map

District of Columbia. Breach notification. Act

DC breach lawDistrict of Columbia data breach notification law (D.C. Code § 28-3851 et seq.)

In force
Partly verifiedMedium confidence. Per-violation civil penalty from recollection of the 2020 Act; summary page did not state amounts.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about District of Columbia residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name or other identifier plus SSN/ITIN, passport, driver's/military ID, financial account codes, medical, genetic/DNA and health insurance data, biometric data; email credentials; any combination enabling identity theft.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Very low regulator threshold (50 residents); 18 months of free identity theft protection where SSN/TIN involved; risk-of-harm exception requires consultation with the AG and federal law enforcement; reasonable security duty.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: DC requires the maintaining entity to notify the owner in the most expedient time possible after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals in the most expedient time possible; AG no later than individuals if >=50 residents; CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $5,000 per violation under the DC Consumer Protection Procedures Act (as applied); residents have a private right of action for actual damages and fees

§3Dates

Key dates
  • Adopted
  • In force
  • Security Breach Protection Amendment Act of 2020 (B23-0215, eff. 2020-06-17)

§4Text and authority

Text
Authority
Office of the Attorney General for the District of Columbia

§5Where it applies

Domestic law of
District of Columbia

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Per-violation civil penalty from recollection of the 2020 Act; summary page did not state amounts.