CA · Breach notification statute
California data breach notification law
Summary
- Statute citation
This state has 2 separate breach notification statutes
Private Sector: Cal. Civ. Code § 1798.82 (Customer Records - Personal Information Breach
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Without unreasonable delay California requires government agencies to notify in the most expedient
Attorney general notice
Yes California requires AG notification when a breach affects more than 500 California residents, with
What counts as a breach
In California 'breach of the security of the system' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency, individual, or business. Good faith acquisition of personal information by an employee or agent for the purposes of the entity is not a breach, provided that the personal information is not used or subject to further unauthorized disclosure.1
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in California
786 reports to HHS OCR affecting 79,958,213 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in California.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Kaiser Foundation Health Plan, Inc. | Health Plan | 13,400,000 | Apr 12, 2024 | Unauthorized Access/Disclosure | Archive (closed) |
| Delta Dental of California | Health Plan | 7,056,189 | Sep 5, 2023 | Hacking/IT Incident | Archive (closed) |
| Episource, LLC | Business Associate | 6,725,572 | Jun 6, 2025 | Hacking/IT Incident | Under investigation |
| Blue Shield of California | Business Associate | 4,700,000 | Apr 9, 2025 | Unauthorized Access/Disclosure | Archive (closed) |
| University of California, Los Angeles Health | Healthcare Provider | 4,500,000 | Jul 17, 2015 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must California businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the California timing rule as: "Without unreasonable delay California requires government agencies to notify in the most expedient". (Source: PRC 2026 survey extract.)
Does California require notice to the attorney general?
The PRC 2026 extract notes: "Yes California requires AG notification when a breach affects more than 500 California residents, with". (Source: PRC 2026 survey extract.)
Does the California law cover biometric data?
Yes. The PRC 2026 survey records biometric data as covered by the California breach law.
Does the California law cover medical information?
Yes. The PRC 2026 survey records medical information as covered by the California breach law.
Does the California law cover paper records?
No. The PRC 2026 survey records the California law as covering computerised data only, not paper records.
Is there a private right of action in California?
Yes. The PRC 2026 survey records a private right of action under the California breach law.
Is credit monitoring required in California?
Yes. The PRC 2026 survey records a credit monitoring requirement in California.
How does the California law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the California statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The California state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws