On March 26, 2020, District of Columbia Mayor Muriel Bowser
signed into law Act 23-268, known as the “Security Breach Protection Amendment Act of
2020.” The Act, which amends section 28 of Chapter 38 of
the District of Columbia Code, broadens the existing definition of
“personal information,” increases the breach notice
contents requirements, provides attorney general notice
requirements, and mandates cybersecurity safeguards. The
Act will take effect after a 30-day congressional review and
publication in the District of Columbia Register. This post
provides a summary of the key details of this Act.
Definition of Personal Information
The Act expands the definition of “personal
information,” which previously included (when combined with
an individual's name) a Social Security number,
driver's license number, District of Columbia identification
card number, a credit or debit card number alone, or any
combination of numbers, codes, or passwords that allowed access
