Washington. Breach notification. Act
WA breach lawWashington data breach notification law (Wash. Rev. Code § 19.255.010 et seq.; § 42.56.590)
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Washington residents to notify affected individuals after a security breach. Core timing rule: Individuals within 30 days of discovery. Covered data: name plus SSN, driver's/state ID, account numbers with codes, full date of birth, private key, student/military/passport ID, health insurance and medical data, biometric data; online credentials.
- Key themes
- Unique features
Payment-processor and vendor liability to financial institutions for card reissuance costs; private right of action.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Washington requires the maintaining entity to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 30 days of discovery; AG within 30 days if >500 residents
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Consumer Protection Act penalties up to $7,500 per violation; private damages
§3Dates
- Key dates
- Adopted
- In force
- HB 1071 (2019, eff. 2020-03-01) set 30-day deadline and broadened PI
§4Text and authority
- Text
- Authoritative text app.leg.wa.gov
- Authority
- Washington Attorney General
§5Where it applies
- Domestic law of
- Washington
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Penalty figure from CPA as amended 2021.