Law / United States / 
Washington
Notice of security breaches involving personal information
RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 March 2020.
A breach notification rule binding private bodies.
As of 2 September 2026.
What it requires
- Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
- Notify the Washington Attorney General of any breach affecting more than 500 Washington residents.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Available to the Washington Attorney General, who may bring an action in the name of the state, or as parens patriae, to enforce this chapter under the Consumer Protection Act because a violation is deemed an unfair or deceptive act under RCW 19.86.020. The consumer's own private civil action under subsection (3)(a) is a separate remedy and, unlike the My Health My Data Act, may not be brought under the Consumer Protection Act's own treble-damages provision, RCW 19.86.090.
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
Statutory damages
No fixed per-person amount and no enhancement: subsection (2) expressly bars bringing this chapter's private action under the Consumer Protection Act's own treble-damages provision, RCW 19.86.090, so a consumer's civil action under subsection (3)(a) recovers only the damages the court awards on ordinary proof, unlike the My Health My Data Act's private action under the same chapter.
- As of
- 2 September 2026
Who enforces it
Enforcement body
Washington Attorney General, who may bring an action in the name of the state, or as parens patriae on behalf of Washington residents, to enforce this chapter under the Consumer Protection Act, RCW 19.86; an injured consumer may also institute a separate civil action under this Section to recover damages.
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Breach notice
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.
Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.