Law / United States / 
California
California Data Breach Notification Law, as amended by SB 446
Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)
In force since .
A breach notification rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice, Security
- Audit expectation
- none
What it requires
- Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
- Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of California (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
California Attorney General; Civ. Code sections 1798.82 to 1798.84 name no dedicated regulator, and the Attorney General's own authority to reach a section 1798.82 violation runs through the general Unfair Competition Law (Bus. and Prof. Code section 17200 et seq.) rather than a provision of this title itself. The Attorney General also receives a sample copy of any breach notification sent to more than 500 California residents.
Settledness
The Attorney General's page describes the sample-copy submission for a breach affecting more than 500 California residents and does not address the 30-calendar-day consumer deadline.
- As of
- Guidance link
- https://oag.ca.gov/privacy/databreach/reporting
- Guidance body
- Office of the Attorney General of California
- Open questions
- When does a business "discover" a breach of the security of the system, so that the 30 calendar days in Civil Code section 1798.82(a)(2)(A) begin to run, given that subparagraph (B) allows delay "as necessary to determine the scope of the breach"?
What it makes you log
Logging duty
Section 1798.82 requires notice to affected residents and, for a breach affecting more than 500 residents, a sample copy of the notice to the Attorney General. It sets no duty to document every breach, whether or not notified, and names no log, no record the business keeps, no retention period and no reader of one. The duty-bearer test, an individual or business that conducts business in California, describes the party and is not an establishment rule, so only the residence of the person notified is written as the hook.
- Kind
- None
- As of
What this law does
Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach. As amended by SB 446 (signed ), the statute now fixes that duty at 30 calendar days, replacing the prior open-ended most-expedient-time-possible standard, and requires notice to the Attorney General within 15 days of consumer notification where a breach affects more than 500 California residents.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .