Data Breach Notice to Residents and State Authorities in District of Columbia
At a glance
| Covered entity and service provider | Person/entity doing business in DC owning/licensing electronic PI gives resident notice; nonowner holder tells owner/licensee as expeditiously as possible (§§ 28-3851(2A), 28-3852(a),(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of electronic data/device compromising PI; identifiers plus government, financial, medical, genetic, insurance, biometric data, or credential combinations (§ 28-3851(1),(3)) |
| Risk screen or notice exception | Excludes secure unusable data unless protection compromised; good-faith employee acquisition; likely-no-harm decision requires reasonable investigation and AG/federal-law-enforcement consultation (§ 28-3851(1)(B)) |
| Individuals who receive notice | DC residents whose personal information was included in breach; owner/licensee receives nonowner holder report (§ 28-3852(a),(b)) |
| Individual notice deadline and clock | Promptly after discovery, in most expedient time possible without unreasonable delay, allowing investigation, restoration and law-enforcement needs; no fixed outer day limit (§ 28-3852(a),(d)) |
| Regulator threshold and deadline | At least 50 DC residents affected: written OAG notice promptly, without unreasonable delay and no later than resident notice; report 11 listed incident details/sample (§ 28-3852(b-1),(b-2)) |
| Consumer-reporting-agency notice | More than 1,000 persons to notify under owner/holder duties: nationwide agencies receive timing, distribution and content without unreasonable delay, not names; GLBA exception (§ 28-3852(c)) |
| Individual delivery and content | Written or consented E-SIGN electronic notice; describe compromised categories and give business, reporting agency, FTC and DC OAG contacts plus security-freeze information; special credentials-only route (§§ 28-3851(2), 28-3852(a-1),(a-2)) |
| Substitute notice conditions and channels | Cost >$50,000, recipients >100,000, or insufficient contact; available email AND website posting if maintained AND major local and applicable national media (§ 28-3851(2)(C)) |
| Delays and alternate compliance | Law-enforcement finding of criminal-investigation impediment permits delay until clearance; specified GLBA/HIPAA/HITECH resident notices may comply, but OAG notice still applies at 50 (§ 28-3852(d),(g)) |
Requirements one by one
The breach and who must act
D.C. Code § 28-3851(1) defines a breach as unauthorized acquisition of electronic data or a device holding it that compromises covered personal information. The expanded § 28-3851(3) list includes medical, genetic, insurance and biometric data, as well as certain credentials and combinations that can enable identity theft without a name. The law excludes secure, unusable data unless obtained information could compromise its protection.
The owner or licensee notifies District residents whose information was included in the breach (§ 28-3852(a)). A person that merely maintains, handles or possesses another's covered data tells the owner or licensee in the most expedient time possible after discovery (§ 28-3852(b)).
Resident, attorney-general and reporting-agency clocks
D.C. Code § 28-3852(a) requires prompt resident notice, in the most expedient time possible without unreasonable delay, allowing necessary breach-scope and system-integrity measures. It sets no fixed outside day count.
When the breach affects 50 or more District residents, § 28-3852(b-1) requires written notice to the DC Office of the Attorney General promptly, without unreasonable delay, and no later than resident notice. The submission includes 11 listed categories, such as affected-person count, compromised data types, cause if known, remedial steps, and a sample resident notice. D.C. Code § 28-3852(b-2) says the agency notice cannot wait just because the total District count is not yet known.
If the person must notify more than 1,000 persons under the owner or holder provisions, § 28-3852(c) also requires notice to nationwide consumer reporting agencies without unreasonable delay. Those agencies get the timing, distribution and content of notices, not recipients' identities; the subsection excludes entities separately required to notify agencies under the Gramm-Leach-Bliley Act.
Delivery and resident notice content
D.C. Code § 28-3851(2) permits written notice, qualifying consented electronic notice, or substitute notice when ordinary notice would cost over $50,000, would reach over 100,000 people, or contact details are insufficient. Substitute notice uses available email, website posting if maintained, and major local and, when applicable, national media.
D.C. Code § 28-3852(a-1) requires the resident notice to describe the information categories to the extent possible and provide business, reporting-agency, Federal Trade Commission and DC attorney-general contacts, with security-freeze information. D.C. Code § 28-3852(a-2) permits a tailored credential-protection message when only the specified account credentials are involved.
What trips people up
The no-harm exception requires consultation. Under § 28-3851(1)(B)(iii), a likely-no-harm determination follows a reasonable investigation and consultation with both the DC attorney general and federal law-enforcement agencies. It is part of the breach definition, not a free-standing waiver.
A federal-compliance route does not erase the DC regulator report. D.C. Code § 28-3852(g) accepts specified GLBA, HIPAA or HITECH resident notice for covered entities, but expressly retains the written OAG notice required by subsection (b-1).
Common questions
Can an investigation delay every notice indefinitely?
No. D.C. Code § 28-3852(a) requires the most expedient notice without unreasonable delay, allowing necessary scope and system-integrity work. Under § 28-3852(d), a law-enforcement agency must find that notice would impede a criminal investigation; notice follows as soon as possible after the agency finds that it will not compromise the investigation.
Can an entity contract out of these duties?
No. D.C. Code § 28-3852(f) makes a waiver of the subchapter void and unenforceable.
Statutes and sources
- D.C. Code § 28-3851 — definitions, covered data and notice methods.
- D.C. Code § 28-3852 — resident, regulator, reporting-agency and holder notice; delivery and delays.
Current official Council bulk statute publication checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does District of Columbia law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current District of Columbia law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace