California's 30-Day Breach Notification Rule: How to Prepare Before You Need It

What changed with SB 446

California has required breach notification for over two decades, but the old standard was "the most expedient time possible and without unreasonable delay," with no fixed number of days. SB 446 adds a hard limit. Notices to affected residents are due within 30 calendar days of discovering or being notified of the breach.

The law keeps a narrow allowance for delay when law enforcement needs it. Ask your attorney how it applies to your facts. Do not assume it covers you.

If more than 500 California residents must be notified, you also send a sample copy of the notice to the Attorney General within 15 days after consumers are notified.

What counts as personal information

The statute covers a person's name combined with sensitive data elements. Examples include:

• Social Security number
• Driver's license or state ID number
• Financial account or card number with the code needed to use it
• Medical or health insurance information
• Certain biometric data

A username or email address combined with its password or security answers also counts.

Two points matter most for preparation:

• Encryption matters. Encrypted data is generally outside the notice requirement if the key was not also compromised. Encrypting laptops, phones and backups changes the outcome of a lost device.
• Vendors have duties too. If you keep data for another business, you must notify the data owner right away. If a vendor holds your data, check that your contract requires them to tell you quickly.

Why 30 days goes fast

A month sounds like enough time. In practice, the steps queue up:

• Days pass before anyone realizes the odd email or slow server was an incident.
• Someone has to work out what was accessed, which takes evidence. Small offices often lack the logs to answer that.
• You need current mailing or email addresses for affected people, sometimes covering years of past clients.
• An attorney has to review the facts and draft the notice.
• If you carry cyber insurance, the carrier usually wants early notice and may direct which attorney or response firm you use.

Preparation will not speed up an investigation, but it removes the delays that come from not knowing who to call.

Build the workflow now: a pre-incident checklist

Do this on a calm day:

• Name your attorney in advance, ideally one with breach experience, and keep the number on paper.
• Read your cyber insurance policy: notice requirements, the hotline, and any approved vendor lists.
• Name decision-makers: who can declare an incident, who talks to counsel, and who approves notices.
• Keep a data inventory: what personal information you hold, where it lives and how long you keep it.
• Maintain contact data for clients and patients so a mailing list can be built quickly.
• Keep logs long enough to matter. Retain email and cloud account sign-in records so you can answer "what did they access?"
• List your vendors that hold personal information, along with their notification obligations to you.
• Prepare a notice skeleton with your attorney, using the required headings below.
• Keep an offline contact sheet in case email is the thing that broke.
• Run a tabletop. Walk through a realistic scenario for an hour and fix what stalls.

For a fuller plan, see the incident response plan guide.

A rough timeline to discuss with counsel

Your attorney sets the real plan. A common shape:

1. Discovery day: contain the problem, preserve evidence (do not wipe and rebuild yet), call counsel and notify your carrier.
2. First week: scope what data and which people are involved, and decide whether outside forensic help is needed.
3. Second and third weeks: confirm who must be notified, build the mailing list, and draft the notice with counsel.
4. By day 30: send notices to residents.
5. Within 15 days after that: if more than 500 residents were notified, send the Attorney General a sample copy.

Keep a dated log of every decision. It helps your attorney and shows the timeline you actually followed.

What the notice must contain

California prescribes a format. The notice is titled "Notice of Data Breach" and uses headings such as "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information," in at least 10-point type.

If Social Security, driver's license or state ID numbers were exposed and your business was the source of the breach, the law generally requires offering identity theft prevention and mitigation services at no cost for at least 12 months. Have counsel confirm what applies to you.

Other clocks that may run at the same time

One incident can trigger several deadlines:

• HIPAA: covered entities generally notify individuals without unreasonable delay, and no later than 60 days. How that interacts with California's 30-day rule is a question for counsel. See hhs.gov and the HIPAA risk analysis guide.
• FTC Safeguards Rule: covered financial-type businesses report to the FTC within 30 days when 500 or more consumers are involved. See the Safeguards Rule WISP guide.
• Defense contracts: DFARS 252.204-7012 requires reporting cyber incidents to DoD within 72 hours. See CMMC readiness.
• Your cyber insurance policy, which often has its own notice terms.

Where Keith Systems fits

Keith Systems does not give legal advice, write legal notices or decide who must be notified. That is your attorney's role. Jacob Keith (CISSP, CompTIA CySA+, CompTIA SecurityX) helps with the technical groundwork before an incident: a data inventory, log retention settings on your own accounts, encryption gaps, a written incident response plan, and a tabletop exercise that tests the 30-day workflow end to end. See incident response readiness or call (805) 800-8163.