Washington
For Washington, statute citation is RCW 19.255.010; individual notice deadline is no more than thirty calendar days after the breach was discovered; individual notice hard deadline (days) is 30; ag / regulator notice deadline is no more than thirty days after the breach was discovered; ag notice resident-count trigger is more than five hundred Washington residents, recorded from its source on 2026-08-18.
- State
- Washington verified
- Statute citation
- RCW 19.255.010
- Individual notice deadline
- no more than thirty calendar days after the breach was discovered verified
- Individual notice hard deadline (days)
- 30 our reading
- AG / regulator notice deadline
- no more than thirty days after the breach was discovered verified
- AG notice resident-count trigger
- more than five hundred Washington residents verified
- Encryption safe harbor
- yes our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
Any person or business that is required to issue a notification pursuant to this section to more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered. (a) The notice to the attorney general shall include the following information: (i) The number of Washington consumers affected by the breach, or an estimate if the exact number is not known; (ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach; (iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach; (iv) A summary of steps taken to contain the breach; and (v) A single sample copy of the security breach notification, excluding any personally identifiable information. (b) The notice to the attorney general must be updated if any of the information identified in (a) of this subsection is unknown at the time notice is due. (8) Notification to affected consumers under this section must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered, unless the delay is at the request of law enforcement as provided in subsection (3) of this section, or the delay is due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
— app.leg.wa.gov, retrieved 2026-08-18
Source
- app.leg.wa.govhttps://app.leg.wa.gov/rcw/default.aspx?cite=19.255.010