Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | District of Columbia |
|---|---|
| Statute citation | D.C. Code §§ 28-3851 to 28-3853 (Consumer Security Breach Notification) (amended 2020) |
| Individual notice timing | Not applicable - government exempt DC explicitly excludes the District of Columbia government and its |
| Attorney general notice | Yes DC requires AG notification when a breach affects 50 or more District residents, no later than when |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | Yes |
| Breach definition (excerpt) | In the District of Columbia 'breach of the security of the system' means unauthorized acquisition of computerized or other electronic data or any equipment or device storing such data that compromises the security, confidentiality, or integrity of personal information maintained by the person or entity who conducts business in the District. It excludes: (1) good-faith employee acquisitions not used improperly; (2) data rendered secure through encryption or redaction unless the security protectio |