Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | California |
|---|---|
| Statute citation | This state has 2 separate breach notification statutes: • Private Sector: Cal. Civ. Code § 1798.82 (Customer Records - Personal Information Breach |
| Individual notice timing | Without unreasonable delay California requires government agencies to notify in the most expedient |
| Attorney general notice | Yes California requires AG notification when a breach affects more than 500 California residents, with |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | Yes |
| Breach definition (excerpt) | In California 'breach of the security of the system' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency, individual, or business. Good faith acquisition of personal information by an employee or agent for the purposes of the entity is not a breach, provided that the personal information is not used or subject to further unauthorized disclosure.1 |