Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | California | New York | Texas |
|---|---|---|---|
| Statute citation | This state has 2 separate breach notification statutes: • Private Sector: Cal. Civ. Code § 1798.82 (Customer Records - Personal Information Breach | N.Y. Gen. Bus. Law §§ 899-aa to 899-bb (Notification of Unauthorized Acquisition of Private Information; Data Security Protections (SHIELD Act)) (amended 2025) | Tex. Bus. & Com. Code §§ 521.001-.152 (Identity Theft Enforcement and Protection Act) (amended 2023) |
| Individual notice timing | Without unreasonable delay California requires government agencies to notify in the most expedient | 30 days New York requires businesses and persons to notify affected individuals in the most expedient | no later than 60 days after determining the breach occurred.33 |
| Attorney general notice | Yes California requires AG notification when a breach affects more than 500 California residents, with | Yes New York requires notification to the Attorney General, Department of State, Division of State Police, | Yes Texas requires AG notification as soon as practicable and no later than 30 days after determining the |
| Biometric data | Yes | Yes | No |
| Medical information | Yes | Yes | Yes |
| Government ID numbers | Not extracted | Not extracted | Not extracted |
| Paper records | No | No | No |
| Private right of action | Yes | No | No |
| Credit monitoring required | Yes | No | No |
| Breach definition (excerpt) | In California 'breach of the security of the system' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency, individual, or business. Good faith acquisition of personal information by an employee or agent for the purposes of the entity is not a breach, provided that the personal information is not used or subject to further unauthorized disclosure.1 | In New York 'breach of the security of the system' means unauthorized access to or acquisition of, or access to or acquisition without valid authorization, of computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business. Good faith access to, or acquisition of, private information by an employee or agent of the business for the purposes of the business is not a breach of the security of the system, provided that the private inform | In Texas 'breach of system security' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data; good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses |