Skip to content
Network USA

Methodology

State breach notification laws

Law pages are built from a best-effort structured extract of the Privacy Rights Clearinghouse Data Breach Notification Laws Survey 2026, which reflects laws enacted as of 1 January 2026. PRC describes the survey as analysing all 50 states and DC with a standardised framework of 50 questions covering notification timing, covered data types, notification recipients, enforcement mechanisms and consumer remedies.

Some fields were not extracted. Where a field is blank we say so ("Not extracted") rather than guessing. Statute citations are blank for Hawaii, Illinois, Indiana and Kansas. Excerpts may be truncated. We do not republish the full survey; read it at privacyrights.org.

PRC 2026 key findings (attributed)

  • Only 20 states (39%) specify numeric deadlines for consumer notification.
  • In 2025 California enacted SB 446, establishing a 30-day deadline for consumer notification and requiring notice to the Attorney General within 15 days of consumer notification when breaches affect 500 or more California residents.
  • 36 states (71%) require entities to report data breaches to the Attorney General or another state agency, but only 21 states make breach notification data publicly accessible through searchable online portals.

Source: Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026, executive summary.

HIPAA breach data

The tracker uses the HHS OCR Breach Portal export (OCR export October 2026): 8,024 reports of breaches affecting 500 or more individuals, 7,271 archived and 753 under investigation, submitted from 2009 to 30 September 2026. Statistics are computed directly from these rows. No outside statistics are used.

Updates

Last updated 2026-10-20. PRC laws as of 1 January 2026; OCR export October 2026.

This is not legal advice. Verify against the current statute and your state attorney general.