# California — US state data breach notification deadlines by state

For California, statute citation is Cal. Civ. Code § 1798.82; individual notice deadline is within 30 calendar days of discovery or notification of the data breach; individual notice hard deadline (days) is 30; ag / regulator notice deadline is within 15 calendar days of notifying affected consumers of the security breach; ag notice resident-count trigger is 500 California residents, recorded from its source on 2026-08-18.

- **State:** California _(verified: appears in the quote below)_
- **Statute citation:** Cal. Civ. Code § 1798.82
- **Individual notice deadline:** within 30 calendar days of discovery or notification of the data breach
- **Individual notice hard deadline (days):** 30 _(our reading, not quoted from the source)_
- **AG / regulator notice deadline:** within 15 calendar days of notifying affected consumers of the security breach _(verified: appears in the quote below)_
- **AG notice resident-count trigger:** 500 California residents _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** GLBA-regulated entities and HIPAA-covered entities are not expressly exempted by this section. The safe harbor covers unencrypted personal information — encrypted personal information is outside the definition of breach unless the encryption key was also acquired. _(our reading, not quoted from the source)_

## What the source says

> 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General within 15 calendar days of notifying affected consumers of the security breach.

## Source

- https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).