California Imposes New Data Breach Notification Requirements

The new law, which takes effect on January 1, 2026, mandates deadlines for data breach notification to affected individuals and the State attorney general. The new law requires disclosure of a data breach “within 30 calendar days of discovery or notification of the data breach,” unless one of two exceptions apply: (1) “to accommodate the legitimate needs of law enforcement” or (2) “[as] necessary to determine the scope of the breach and restore the reasonable integrity of the data system.” Additionally, disclosures of a data breach will be required to be made to the California Attorney General “within 15 days of notifying affected consumers of the security breach” when more than 500 California residents have been notified. The new statutory deadlines are intended to promote timely notification addressing the absence of specific notification deadlines under current law.