Data Breach Notice to Residents and State Authorities in Washington

At a glance

Requirements one by one

Covered data and the harm screen

RCW § 19.255.005 defines a breach as unauthorized acquisition of personal information that compromises its security, confidentiality, or integrity. Covered combinations include a name with financial, identification, medical, insurance, biometric, birth-date, and other listed data. Login credentials also count, and certain data elements without a name count if they can enable identity theft. Publicly available government information is excluded. Section 19.255.010(1) requires resident notice for unsecured information but excuses it when the breach is not reasonably likely to subject consumers to a risk of harm. Its secured-data protection can fall away if the data become accessible or the deciphering means are acquired.

Recipients and clocks

Under § 19.255.010(2), a nonowner maintainer or possessor tells the owner or licensee immediately after discovering a breach involving acquired or reasonably believed acquired information. The owner or licensee notifies affected Washington residents under subsection (1). Subsection (8) demands the most expedient notice possible, without unreasonable delay, within 30 calendar days after discovery, subject to its stated delays.

More than 500 Washington residents receiving notice from one breach calls for an Attorney General filing no more than 30 days after discovery under § 19.255.010(7). The report gives the affected count or estimate, data types, known exposure period, containment summary, and a sample resident notice without personally identifiable information. Unknown items must be updated. The general statute does not require a separate report to consumer-reporting agencies; its resident letter instead supplies their toll-free numbers and addresses.

Delivery and substitute notice

Section 19.255.010(4) allows writing and E-SIGN-consistent electronic notice. Its credential route permits electronic or email notice with directions to protect the affected and reused accounts; an entity cannot send notice to the breached email account it furnishes. Subsection (6) requires plain language, the business name and contact, affected data types, a known exposure period including breach and discovery dates, and the major credit reporting agencies' toll-free numbers and addresses. For direct cost over $250,000, more than 500,000 recipients, or insufficient contact information, substitute notice combines available email, a website post if maintained, and major statewide media.

What trips people up

The two 30-day clocks start at discovery. Resident notice under § 19.255.010(8) and the qualifying AG report under subsection (7) both use discovery, not a later harm-screen conclusion. An investigation may justify the specific law-enforcement or system-restoration delays stated in subsections (3) and (8).

Alternate compliance is conditional. A consistent information-security policy can satisfy § 19.255.010(5) when followed. RCW § 19.255.030 has separate routes for HIPAA-covered information and specified financial institutions; those entities still have the Attorney General duties that section preserves.

Common questions

Does every breach require AG reporting? No. Section 19.255.010(7) sets the AG report at more than 500 Washington residents notified from a single breach.

Can the business omit an unknown exposure date from the AG report? Section 19.255.010(7)(b) requires an update when information required by subsection (7)(a) was unknown at the filing deadline.

Statutes and sources

• RCW §§ 19.255.005, 19.255.010, and 19.255.030 — definitions, notification duties, and sector compliance. https://app.leg.wa.gov/rcw/default.aspx?cite=19.255.010 (accessed 2026-10-14)