CALIFORNIA · BREACH NOTIFICATION

How fast must a company report a data breach in California?

California Civil Code § 1798.82

PILOT PROFILELAST VERIFIED · OCT 24 2026

Notice to individuals

Within 30 calendar days of discovery or notification of the breach. Delay is allowed for legitimate law-enforcement needs, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Notice to the Attorney General

If more than 500 California residents must be notified for a single breach: submit one sample copy of the notice (without personally identifiable information) to the Attorney General within 15 calendar days of notifying consumers.

Notice content and publication

The statute sets a model format: a plain-language notice titled "Notice of Data Breach" with required headings and, at a minimum, a general description of the incident and the date of the notice.

What changed

Before 2026 the individual-notice standard was "most expedient time possible and without unreasonable delay," and the Attorney General sample copy had no deadline. SB 446 added both fixed deadlines. Some law-firm summaries describe the 15 days as running from discovery; the statute text says it runs from notifying affected consumers.

Primary sources and verification

• California Civil Code § 1798.82 (official legislative information)
• SB 446 bill page (2025–26 session)
• Senate Judiciary Committee analysis of SB 446
• California Attorney General — data breach list

Last verified: October 24, 2026. Pilot profile: the full Research Card v2.1 standard (exemptions, definitions of personal information, enforcement) is still being added.

ALL BREACH NOTIFICATION PROFILES →   CALIFORNIA PRIVACY LAW →