# Washington — US state data breach notification deadlines by state

For Washington, statute citation is RCW 19.255.010; individual notice deadline is no more than thirty calendar days after the breach was discovered; individual notice hard deadline (days) is 30; ag / regulator notice deadline is no more than thirty days after the breach was discovered; ag notice resident-count trigger is more than five hundred Washington residents, recorded from its source on 2026-08-18.

- **State:** Washington _(verified: appears in the quote below)_
- **Statute citation:** RCW 19.255.010
- **Individual notice deadline:** no more than thirty calendar days after the breach was discovered _(verified: appears in the quote below)_
- **Individual notice hard deadline (days):** 30 _(our reading, not quoted from the source)_
- **AG / regulator notice deadline:** no more than thirty days after the breach was discovered _(verified: appears in the quote below)_
- **AG notice resident-count trigger:** more than five hundred Washington residents _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_

## What the source says

> Any person or business that is required to issue a notification pursuant to this section to more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered. (a) The notice to the attorney general shall include the following information: (i) The number of Washington consumers affected by the breach, or an estimate if the exact number is not known; (ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach; (iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach; (iv) A summary of steps taken to contain the breach; and (v) A single sample copy of the security breach notification, excluding any personally identifiable information. (b) The notice to the attorney general must be updated if any of the information identified in (a) of this subsection is unknown at the time notice is due. (8) Notification to affected consumers under this section must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered, unless the delay is at the request of law enforcement as provided in subsection (3) of this section, or the delay is due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

## Source

- https://app.leg.wa.gov/rcw/default.aspx?cite=19.255.010

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).