Since January 1, 2026, a California business that suffers a data breach has a hard deadline: affected residents must be told within 30 calendar days of discovery. For years the law only asked for notice in "the most expedient time possible and without unreasonable delay," which left room for slow letters. Senate Bill 446, signed by Governor Newsom on October 3, 2025, replaced that phrase with a number.
Here is what the California data breach notification law, Civil Code Section 1798.82, now asks of a business, in the order you would face it during a bad week. This is general information from people who run IT and security, not legal advice. Your attorney makes the legal calls. Our job is making sure the facts and logs are ready when they do.
Who the California data breach notification law covers, even outside the state
Section 1798.82 applies to any person or business that conducts business in California and owns or licenses computerized data that includes personal information. A business that only maintains data it does not own, such as a payroll processor or billing service, has a different duty: it must notify the data owner immediately after discovering a breach, and the owner handles the notices. This month's California student data breach at ETS followed that pattern, with a contractor's system breached and notices sent at the direction of the agency that owned the records. Government agencies follow a sister statute, Section 1798.29, which still uses the older "most expedient time possible" standard.
What counts as personal information under Civil Code 1798.82
The definition works two ways. The first is a first name or first initial and last name combined with at least one sensitive element, when either is unencrypted. The elements are a Social Security number; a driver's license, California ID, tax ID, passport, military ID, or similar government number; a financial account or card number with any code needed to use it; medical information; health insurance information; biometric data used to authenticate someone; automated license plate recognition data; and genetic data.
The second path needs no name at all. A username or email address combined with a password or security question and answer that would permit access to an online account is personal information on its own. For an office on Microsoft 365, that means a phishing kit capturing an employee's login can trigger the law even when no Social Security number was anywhere nearby.
A breach means unauthorized acquisition of computerized data that compromises its security, confidentiality, or integrity. Because the trigger is acquisition, or a reasonable belief of it, your logs decide a great deal. If you can show exactly which files an intruder opened, you may notify a few dozen people instead of thousands. Without logs, you may have to assume the worst, which is a strong argument for threat detection and response that keeps detailed records.
The encryption safe harbor, and the catch most offices miss
Encrypted data is generally outside the notice requirement, with encrypted defined as unusable, unreadable, or indecipherable to an unauthorized person through generally accepted security technology. A stolen laptop with full disk encryption is usually a lost laptop, not a reportable breach. The catch sits in the same sentence: if the encryption key or security credential was also acquired, and you reasonably believe it could make the data readable, the safe harbor falls away. Most account attacks never break encryption. They log in, and the data opens exactly as it would for the real user. That is why multifactor sign in matters as much for breach law as for security.
The 30 day clock: when it starts and what can pause it
Notice to residents is due within 30 calendar days of discovery or notification of the breach. Two delays remain. A law enforcement agency can determine that notice would impede a criminal investigation, and notice then goes out promptly once the agency clears it. A business may also delay as necessary to determine the scope of the breach and restore the reasonable integrity of its systems. Treat that second exception as narrow, and expect to explain any delay in writing later.
Thirty days disappears fast once you add forensics, current addresses, a credit monitoring vendor, and printing. Businesses that meet it calmly decided most of this in advance, in a written incident response plan that names who calls the lawyer, who calls the insurer, and who pulls the logs.
When you must also notify the California Attorney General
If a single breach requires notice to more than 500 California residents, you must electronically submit one sample copy of the notice, with no personal information in it, to the Attorney General. SB 446 added a deadline here as well: within 15 calendar days of notifying consumers. The Attorney General's data security breach reporting page hosts the submission form and a searchable list of published notices, so write your letter knowing customers, reporters, and plaintiffs' firms may read it.
What the notice letter must say, heading by heading
The notice must be in plain language, titled "Notice of Data Breach," and organized under the headings "What Happened?", "What Information Was Involved?", "What We Are Doing," "What You Can Do," and "For More Information." Headings must be clearly displayed and text can be no smaller than 10 point type. The statute includes a model form, and using it is deemed compliant.
The letter must include your name and contact information, the types of personal information involved, the date or date range of the breach if known, and the date of the notice. It must say whether law enforcement delayed the notice and give a general description of what happened. If Social Security, driver's license, or California ID numbers were exposed, include the toll free numbers and addresses of the major credit reporting agencies. If your business was the source of that breach, you must also offer identity theft prevention and mitigation services at no cost for at least 12 months. A HIPAA covered entity is deemed to meet the content rules if it fully complies with federal breach notice requirements, though the rest of the section still applies. Our guide to the HIPAA breach notification rule covers the federal side.
How notice can be delivered, including the rule for stolen email passwords
Notice can be written, or electronic if it follows federal electronic signature law. Substitute notice is allowed when notifying would cost more than $250,000, more than 500,000 people are affected, or contact information is missing, and it requires email where possible, a conspicuous link on your home page for at least 30 days, and notice to major statewide media. When only online logins were exposed, an electronic notice telling people to change their passwords can satisfy the law. When the stolen credentials belong to an email account you provide, you may not send the notice to that same compromised mailbox.
Why reasonable security matters before the breach, not after
Section 1798.81.5 requires businesses holding personal information about Californians to maintain reasonable security appropriate to that information, and to require the same by contract from vendors. Under Section 1798.150 of the California Consumer Privacy Act, consumers can sue when nonencrypted, nonredacted personal information is stolen because a business failed that duty, for $100 to $750 per consumer per incident or actual damages if greater, with amounts adjusted over time. Fixing security after the breach does not count as a cure. That is where vendor contracts and third party risk management stop being paperwork.
What to prepare now, while nothing is on fire
Map where personal information lives: the practice system, the shared drive, the scanner inbox, old exports in someone's OneDrive. Then shrink it. Every record deleted on schedule under a written data retention policy is a record you never have to notify anyone about.
Make the safe harbor real by encrypting laptops, phones, and backups and putting multifactor sign in on every login. Keep audit logs long enough to answer "what exactly did they take?" weeks later. Draft a notice template with the five statutory headings so your attorney edits instead of starting from zero. Choose breach counsel and a forensic firm in advance, and check whether your policy requires specific vendors; our article on cyber liability insurance explains what to look for.
For a quick read on where you stand, try our free security score tool.
How GlobeVM helps
For 30 years GlobeVM has run IT and security for businesses in Los Angeles, and we support more than 75 organizations across Southern California. Firewall management, endpoint protection, email filtering, and multifactor sign in are standard in every plan, closing the most common doors before they become a 30 day deadline. We monitor around the clock, and when something looks wrong, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners. Our compliance and risk management services help you map your data, keep the logs your attorney will ask for, and rehearse the response before you need it. We work in English and Farsi.
Call (818) 405-9930 or book a free IT assessment, and we will show you where a breach would hurt most and how to make it smaller.