Data Breach Notice to Residents and State Authorities in California
At a glance
| Covered entity and service provider | CA business or individual owning/licensing computerized personal information notifies residents; nonowner custodian notifies owner/licensee immediately (§ 1798.82(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of covered data; name plus listed identifiers, health, biometric, plate, or genetic data, or account credentials; encrypted data counts if usable key/credential acquired (§ 1798.82(a), (g)-(k)) |
| Risk screen or notice exception | Actual or reasonably believed unauthorized acquisition governs; § 1798.82(a), (g) states no separate risk-of-harm waiver |
| Individuals who receive notice | California resident whose covered unencrypted data, or encrypted data with usable key/credential, was or is reasonably believed acquired (§ 1798.82(a)(1)) |
| Individual notice deadline and clock | Within 30 calendar days after discovery or notice of breach; law-enforcement or necessary scope/restoration delay can extend it (§ 1798.82(a)(2), (c)) |
| Regulator threshold and deadline | More than 500 California residents from one breach: electronically send AG one redacted sample of resident notice within 15 calendar days after notifying residents (§ 1798.82(f)) |
| Consumer-reporting-agency notice | No separate agency submission under § 1798.82; resident notice must give major agencies' toll-free numbers and addresses if SSN, driver license, or CA ID exposed (§ 1798.82(d)(2)(F)) |
| Individual delivery and content | Written or E-SIGN electronic notice; plain-language titled notice, named headings, ≥10-point type, sender/contact, data types, available dates and incident facts, plus conditional credit-agency and mitigation items (§ 1798.82(d), (j)) |
| Substitute notice conditions and channels | Cost over $250,000, more than 500,000 people, or insufficient contacts; all applicable email, conspicuous website posting for ≥30 days, and statewide media (§ 1798.82(j)(3)) |
| Delays and alternate compliance | Police delay until investigation safe; necessary scope/restoration delay; compliant own-policy method; HIPAA/HITECH compliance substitutes for notice-content subdivision only (§ 1798.82(a)(2), (c), (e), (l)) |
Requirements one by one
Covered breach and information
Section 1798.82(g) defines the breach as “unauthorized acquisition of computerized data” that compromises covered personal information. Subdivision (h) includes name-plus-identifier combinations and online-account credentials as separate routes. Subdivision (a)(1) also reaches encrypted data when the decryption key or security credential was, or is reasonably believed to have been, acquired and the owner reasonably believes it could make the information readable or usable.
Resident notice clock
The 30-calendar-day clock starts on discovery or notification of the breach, not when an investigation ends (§ 1798.82(a)(2)(A)). Subparagraph (B) permits time needed to determine the scope and restore reasonable system integrity, or to meet legitimate law-enforcement needs under subdivision (c). A separate police delay ends when the agency determines notice will no longer compromise its investigation.
Resident notice contents
Under § 1798.82(d), the notice must be in plain language, titled “Notice of Data Breach,” use the named headings, and have text at least 10-point size. It gives the sender's name and contact details, types of affected information, and available dates and incident facts. If a social security number, driver license number, or California ID number was exposed, it also gives major credit-reporting agencies' toll-free numbers and addresses. If the sender was the breach source and specified identification data was or may have been exposed, it must offer appropriate identity-theft prevention and mitigation services at no cost for at least 12 months with instructions for using them.
Attorney-general sample and substitute delivery
For a single breach requiring notices to more than 500 residents, subdivision (f) calls for one electronic sample copy to the Attorney General, stripped of personally identifiable information, within 15 calendar days after notifying residents. This is a sample of the resident notice, not a separate incident report form.
Section 1798.82(j)(3) allows substitute notice when direct notice would cost more than $250,000, the affected class exceeds 500,000 people, or contacts are insufficient. It requires all applicable channels: email where addresses are held, a conspicuous website posting for at least 30 days if there is a website, and notice to major statewide media.
What trips people up
The processor has its own immediate notice duty. An entity holding data it does not own must tell the owner or licensee immediately after discovery when covered information was or is reasonably believed acquired (§ 1798.82(b)). That handoff precedes the owner's resident-notice process.
The credit-reporting-agency reference is part of the resident letter. Subdivision (d)(2)(F) requires agency contact details for certain exposed identifiers. Subdivision (f)'s separate filing goes to the Attorney General, after the residents are notified.
Common questions
Can the notice go to an affected company-provided email account? For a breach of that email account's login credentials, § 1798.82(j)(5) bars notice to that address. The sender must use another allowed method or the specified clear online notice when the resident accesses the account from a customary location.
Does a health-care entity's federal notice remove every state duty? No. Section 1798.82(e) deems complete compliance with the named federal content rule sufficient for California's subdivision (d) notice-content requirements; it expressly preserves the rest of § 1798.82.
Statutes and sources
- Cal. Civ. Code § 1798.82 — private-entity breach trigger, resident and AG notice, contents, methods, and delays. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does California law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current California law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace