Skip to content
Network USA

DC · Breach notification statute

District of Columbia data breach notification law

A summary of the District of Columbia breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

D.C. Code §§ 28-3851 to 28-3853 (Consumer Security Breach Notification) (amended 2020)

Last amended
2020 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Not applicable - government exempt DC explicitly excludes the District of Columbia government and its

Attorney general notice

Yes DC requires AG notification when a breach affects 50 or more District residents, no later than when

What counts as a breach

In the District of Columbia 'breach of the security of the system' means unauthorized acquisition of computerized or other electronic data or any equipment or device storing such data that compromises the security, confidentiality, or integrity of personal information maintained by the person or entity who conducts business in the District. It excludes: (1) good-faith employee acquisitions not used improperly; (2) data rendered secure through encryption or redaction unless the security protectio

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredYes

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in District of Columbia

34 reports to HHS OCR affecting 741,808 individuals. Most common type: Unauthorized Access/Disclosure. See all HIPAA breaches in District of Columbia.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Trusted Health Plans, Inc.Health Plan200,665Mar 26, 2021Hacking/IT IncidentArchive (closed)
Planned Parenthood of Metro WashingtonHealthcare Provider142,982Nov 20, 2020Hacking/IT IncidentArchive (closed)
Howard University College of DentistryHealthcare Provider80,915Nov 23, 2021Hacking/IT IncidentArchive (closed)
Casper Orthopedic Associates, PCHealthcare Provider56,197Jul 23, 2026Hacking/IT IncidentUnder investigation
Veterans Health AdministrationHealthcare Provider46,677Jan 30, 2024Unauthorized Access/DisclosureArchive (closed)

Frequently asked questions

When must District of Columbia businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the District of Columbia timing rule as: "Not applicable - government exempt DC explicitly excludes the District of Columbia government and its". (Source: PRC 2026 survey extract.)

Does District of Columbia require notice to the attorney general?

The PRC 2026 extract notes: "Yes DC requires AG notification when a breach affects 50 or more District residents, no later than when". (Source: PRC 2026 survey extract.)

Does the District of Columbia law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the District of Columbia breach law.

Does the District of Columbia law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the District of Columbia breach law.

Does the District of Columbia law cover paper records?

No. The PRC 2026 survey records the District of Columbia law as covering computerised data only, not paper records.

Is there a private right of action in District of Columbia?

Yes. The PRC 2026 survey records a private right of action under the District of Columbia breach law.

Is credit monitoring required in District of Columbia?

Yes. The PRC 2026 survey records a credit monitoring requirement in District of Columbia.

How does the District of Columbia law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the District of Columbia statute, and see our HIPAA vs state breach notification laws guide.

Sources