Law note · California

California Data Breach Notification Law, as amended by SB 446

cite Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319) stage In effect since 2026-01-01 reviewed 2026-08-23

Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach. As amended by SB 446 (signed October 3, 2025), the statute now fixes that duty at 30 calendar days, replacing the prior open-ended most-expedient-time-possible standard, and requires notice to the Attorney General within 15 days of consumer notification where a breach affects more than 500 California residents.

What it asks of an app

Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents.

When LexLint raises it

Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_voice, processes_biometrics

Primary source: Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)

← Back to the example · Lint your app →