Data Security & Breach Notification
California data breach notification law
California · Varies by state
Requires "reasonable security procedures and practices" for any business owning/licensing CA residents' personal information. SB 446 (effective Jan 1, 2026) added California's first hard breach-notification deadlines: 30 calendar days to notify affected consumers, plus a new 15-day AG notice deadline (for breaches affecting 500+ residents) and a processor-to-owner notice duty. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual revenue, data volume, and data types.