California Data Breach Notice Law Requires Consumer Alerts Within 30 Days

All 50 States, as well as the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, have data breach laws that require organizations to notify individuals affected by data breaches that involve personal identifying information. Under this umbrella of laws, certain states have specific requirements dictating how and when consumers must be notified. For example, California’s Senate Bill No. 446, which took effect in January 2026, generally requires organizations to disclose data breaches to California residents within 30 days of discovering them.

SB 446 applies to any business, individual, or organization that conducts business in California and digitally owns or licenses digital data containing personal information. Examples of personal information include Social Security information, tax identification numbers, driver’s license numbers, credit card information, unique biometric or genetic data, medical or health-insurance information, and login information paired with