Regulatory Defense

California Data Breach Notification Requirements

By Ingrid Rainey · January 27, 2026 · 8 min read

Updated July 8, 2026

Editorial photo illustrating California Data Breach Notification: What a Business Must Do

California's breach notification statute applies to any business that owns or licenses computerized personal information about a California resident — regardless of where the business is located. The obligation is triggered by unauthorized acquisition of unencrypted personal information, notice must go out in the most expedient time possible without unreasonable delay, and a breach affecting more than 500 Californians also goes to the Attorney General. Layered on top, the CCPA gives consumers a private right of action with statutory damages for breaches caused by inadequate security.

Key takeaways

Civil Code sections 1798.29 and 1798.82 require notice without unreasonable delay after discovery of a breach of unencrypted personal information.
Breaches affecting more than 500 California residents require a sample notice submitted to the Attorney General.
The notice content is prescribed by statute — a general apology email does not satisfy it.
The CCPA allows statutory damages of $100 to $750 per consumer per incident for breaches resulting from failure to maintain reasonable security.

What counts as a reportable breach

The statute turns on unauthorized acquisition of unencrypted computerized data that compromises security, confidentiality, or integrity of personal information. Personal information means a name plus a data element such as a Social Security number, driver's license or state ID number, financial account credentials, medical or health insurance information, biometric data, or genetic data. Certain login credentials alone also qualify.

Encryption is the practical safe harbor, but only if the encryption key was not also acquired. A laptop with full-disk encryption that was powered off is a very different incident from one taken while unlocked with the key resident on the device.

The first 72 hours

Contain first — isolate affected systems, rotate credentials, and preserve logs before they roll over.
Engage counsel early so forensic work can be structured to preserve privilege where available.
Notify your cyber insurer; most policies have prompt-notice conditions and panel vendor requirements.
Determine scope: what data, whose data, which states and countries are implicated.
Preserve evidence and document decisions contemporaneously — regulators ask for the timeline later.

Notice content and method

California prescribes the format: a title and headings, plain language, and specified sections covering what happened, what information was involved, what the business is doing, what the recipient can do, and contact information. Where Social Security or driver's license numbers were involved, the notice must offer identity theft prevention and mitigation services at no cost for at least 12 months.

Written or electronic notice is the default. Substitute notice — email plus a conspicuous website posting plus major statewide media — is available where cost exceeds $250,000, the affected class exceeds 500,000, or contact information is insufficient.

Have a question about your situation?

Rainey Law P.C. advises San Diego businesses and employees on matters like this one.

Request a consultation

Regulators and the overlapping regimes

More than 500 California residents affected means a sample copy of the notice goes to the Attorney General electronically. Health data may bring in HIPAA's 60-day rule and HHS reporting; financial institutions have GLBA obligations; publicly traded companies face SEC materiality disclosure timelines; and EU or UK residents trigger GDPR's 72-hour supervisory authority deadline.

Multi-state incidents are the norm. Every state has its own statute with different definitions and deadlines, and the operational answer is usually a single coordinated notification project rather than fifty separate analyses.

Reducing exposure before the incident

Encrypt personal information at rest and in transit — the single highest-leverage control under this statute.
Maintain a written incident response plan and actually run a tabletop exercise against it.
Adopt a recognized security framework; 'reasonable security' under the CCPA is measured against something.
Push security and breach-notice obligations down to vendors by contract, with cooperation and timing commitments.
Minimize data retention — information you no longer hold cannot be breached.

Frequently asked questions

How fast must we notify in California?

In the most expedient time possible and without unreasonable delay, subject to the needs of law enforcement and measures to restore system integrity. California does not set a fixed day count, but delays measured in months invite scrutiny.

Does encrypted data trigger notice?

Generally not, provided the encryption key or security credential was not also acquired. That caveat matters and is frequently overlooked.

Can consumers sue us for a breach?

Yes. The CCPA provides a private right of action with statutory damages of $100 to $750 per consumer per incident for breaches of certain unencrypted personal information caused by a failure to maintain reasonable security.

Do we have to notify if a vendor was breached?

If you own or license the data, the notification duty to individuals is generally yours. The vendor must notify you, which is why contractual timing commitments matter.

This article is general information, not legal advice, and does not create an attorney-client relationship. Outcomes depend on the facts of each matter.

More insights