California Data Breach Notification Law, as amended by SB 446

Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A breach notification rule binding private bodies.

As of 23 August 2026.

What it requires

Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Who enforces it

Enforcement body

California Attorney General; Civ. Code sections 1798.82 to 1798.84 name no dedicated regulator, and the Attorney General's own authority to reach a section 1798.82 violation runs through the general Unfair Competition Law (Bus. and Prof. Code section 17200 et seq.) rather than a provision of this title itself. The Attorney General also receives a sample copy of any breach notification sent to more than 500 California residents.

What it reaches

Obligation class

Breach notice, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach. As amended by SB 446 (signed October 3, 2025), the statute now fixes that duty at 30 calendar days, replacing the prior open-ended most-expedient-time-possible standard, and requires notice to the Attorney General within 15 days of consumer notification where a breach affects more than 500 California residents.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_voice
processes_biometrics

Read the law

Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app