Data breach reporting in California: the deadlines, who you must notify, and how you would know

Since January 1, 2026, California businesses must notify affected residents within 30 calendar days of discovering a breach. Medical offices, tax preparers and card-accepting businesses have their own clocks too. The hard part is not the letter, it is knowing it happened.

Check my detection and response Call or text (760) 684-4139

★ Serving local businesses 30+ years✓ Plain English, no pressure

The short version

California (SB 446): notify affected residents within 30 calendar days of discovery. If more than 500 Californians are affected, send the Attorney General a sample notice within 15 days after that.
HIPAA: notify patients no later than 60 days after discovery. 500 or more: also HHS and, if 500 or more in one state, the media.
FTC Safeguards Rule (tax preparers, mortgage brokers, auto dealers and other non-bank financial businesses): notify the FTC within 30 days if 500 or more consumers are affected.
IBM 2025: the average breach took 181 days to identify and 60 more to contain. The US average cost was $10.22 million.
Breaches a business finds itself cost far less than ones an attacker or outsider discloses.

The clock starts at discovery

Every deadline below counts from the day you discover the breach or are told about it. California allows a delay only for legitimate law enforcement needs or as needed to determine the scope of the breach and restore the system. That makes detection and a ready response plan essential.

Who you may have to notify

Law	Who it covers	Deadline
California Civil Code 1798.82 (SB 446)	Any business with computerized personal information of California residents	Residents within 30 calendar days. Attorney General sample notice within 15 days after, if more than 500 residents
HIPAA Breach Notification Rule	Medical, dental, chiropractic, therapy offices and their business associates	Patients no later than 60 days. HHS within 60 days if 500 or more (yearly log if fewer). Media if 500 or more in one state
FTC Safeguards Rule	Non-bank financial businesses, including tax preparers, mortgage brokers and auto dealers	FTC within 30 days if 500 or more consumers' unencrypted information
PCI DSS and your merchant agreement	Any business that takes credit cards	Notify your card processor promptly as your agreement requires
Your cyber insurance policy	Insured businesses	Usually prompt notice before you hire outside help

The detection problem

You cannot report what you cannot see. IBM's 2025 Cost of a Data Breach Report found the average breach went 181 days before it was identified and took another 60 days to contain. Breaches using stolen passwords took the longest, about 292 days. Breaches contained in under 200 days cost about $3.87 million on average, versus $5.01 million for those that ran longer.

What detection actually takes

Firewall logging and alerts that someone reviews (WatchGuard® Cloud)
Endpoint detection and response on every computer (Bitdefender GravityZone)
Microsoft 365 sign-in alerts and multi-factor authentication
Email security to stop phishing, the most common way in
Tested backups that ransomware cannot erase
A written incident response plan with who to call and in what order

This is why we recommend layered security: each layer catches what another misses and leaves a record that tells you what happened, when, and whose information was involved.

What counts as personal information in California

Generally a person's name together with things like a Social Security number, driver license or ID number, financial account or card number with its code, medical or health insurance information, or a username or email with its password. If your systems hold any of these for customers, patients, donors or employees, the law applies to you.

You have 30 days to report a breach. Would you even know you had one?Check my detection and response

Sources

This guide is general information for business owners, not legal advice. Laws change; confirm your specific obligations with your attorney, compliance officer or diocese. Last reviewed November 2026.