Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Washington |
|---|---|
| Statute citation | This state has 2 separate breach notification statutes: • Private Sector: RCW 19.255 (Personal Information: Notice of Security Breaches) (amended |
| Individual notice timing | 30 days Washington requires businesses to notify affected consumers in the most expedient time possible |
| Attorney general notice | Yes Washington requires Attorney General notification when breaches affect more than 500 Washington |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Washington 'breach of the security of the system' means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system when the personal information is not used or subject to further unauthorized disclosure. 1 |