All 50 States, as well as the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, have data breach laws that require organizations to notify individuals affected by data breaches that involve personal identifying information. Under this umbrella of laws, certain states have specific requirements dictating how and when consumers must be notified. For example, California’s Senate Bill No. 446, which took effect in January 2026, generally requires organizations to disclose data breaches to California residents within 30 days of discovering them.
SB 446 applies to any business, individual, or organization that conducts business in California and digitally owns or licenses digital data containing personal information. Examples of personal information include Social Security information, tax identification numbers, driver’s license numbers, credit card information, unique biometric or genetic data, medical or health-insurance information, and login information paired with a password or security information, among others.
Given the recent influx of data breach notices reported to the California Attorney General, SB 446 is more relevant than ever for consumers seeking to know their rights when it comes to data privacy. This article will explain what California’s new notification law requires, what a data breach notice should include, what steps consumers can take, and what legal options may be available for those affected.
What Does California’s New Data Beach Notification Law Require?
Prior to January 1, 2026, Cal. Civ. Code § 1798.82(a) required organizations or individuals that conduct business in California to disclose relevant data breaches to California residents “in the most expedient time possible and without unreasonable delay.” Through the passage of SB 446, the California legislature addressed concerns about the previous law’s indefinite timeline, thereby granting greater protections to California consumers. As a rationale for this change, the California Senate Judiciary Committee cited the “stunning incidence of data breaches” in recent years and pointed to the fact that vast numbers of California residents communicate sensitive personal, financial, health, or insurance information using the internet.
While SB 446 requires notification within 30 calendar days, it still provides an exception for businesses to delay disclosure “to accommodate the legitimate needs of law enforcement . . . or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.” However, this provision does not mean that companies may delay notice merely due to the existence of an ongoing law enforcement investigation. Rather, a law enforcement agency must determine that notice would “impede a criminal investigation.” Following law enforcement’s determination that notice would no longer cause this imposition, notice must be made promptly.
What Should a Data Breach Notice Include?
The requirements for what must be disclosed in a data breach notice can vary under different state laws. In California, the business or individual that experienced the data breach produce a document titled “Notice of Data Breach,” which discloses the name of the reporting business or individual, the types of personal information believed to have been the subject of a breach, information regarding the date of the breach, a general description of the breach, explanation for any delayed notice (if applicable), and whether the business or individual is providing identity theft or mitigation services.
What Steps Can Consumers Take?
A consumer should not assume that nothing can be done when they receive a notice of a data breach. Rather, there are several proactive steps that individuals can take if they believe their information has been compromised. First, a consumer should read the breach notification carefully to determine exactly what information has been exposed. Then, the consumer should consider changing all potentially compromised passwords and enabling multifactor authentication systems. The consumer should consistently monitor financial and credit accounts, and if applicable, consider whether a fraud alert or credit freeze may be appropriate. Historically, consumers have also saved the original notice, documented when it was received, and maintained records of any damages potentially relating to the breach.
What Legal Options Are Available?
Depending on the type of information exposed, the organization’s security procedures, and the harm suffered, a class action lawsuit may be an appropriate remedy. Under California Civil Code § 1798.150, consumers affected by a data breach may institute a civil lawsuit to recover damages, injunctive or declaratory relief, or any other relief the court deems proper.
Although a violation of SB 446’s 30-day notice requirement does not in itself establish a right to damages, evidence that a business failed to provide appropriate notice may be relevant to evaluating an affected consumer’s claims and any harm that resulted from the business’s actions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
