U.S. California SB-1386

Why does it matter?

Section 1798.82 is the breach law that reaches any business holding data on California residents, wherever the business sits, and the Attorney General publishes every sample notice it receives, so a late or thin notice is a public record. Section 1798.84 lets any customer injured by a violation of the title sue for damages and seek an injunction, and the Legislature's 2002 findings explain the urgency: identity theft victims must act quickly, so expeditious notice of possible misuse is imperative (Section 1(e)). Since the 2025 amendment the standard is no longer only without unreasonable delay but 30 calendar days from discovery, with the Attorney General copy due 15 calendar days after residents are told (section 1798.82(a)(2) and (f)).

Key benefits include:

• A single trigger

Unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information (1798.82(g)); good-faith acquisition by an employee or agent is not a breach if the data are not misused or further disclosed.

• Encryption as the line

Only unencrypted personal information triggers notice, unless the encryption key or security credential was also acquired and could render the data readable (1798.82(a)(1)); encrypted means rendered unusable, unreadable or indecipherable by a generally accepted method (1798.82(i)(4)).

• A fixed clock since 2025

Disclosure within 30 calendar days of discovery or notification, with delay allowed only for law enforcement needs or to determine the scope of the breach and restore system integrity (1798.82(a)(2) and (c)).

• A prescribed notice

Plain language, the title Notice of Data Breach, the headings What Happened, What Information Was Involved, What We Are Doing, What You Can Do and For More Information, 10-point type and the listed contents (1798.82(d)).

• A regulator copy

More than 500 California residents notified from one breach means a sample notice to the Attorney General within 15 calendar days, which the Attorney General publishes (1798.82(f)).

How does it work?

SB 1386 added two parallel sections. Section 1798.29 binds state agencies; section 1798.82 binds any person or business that conducts business in California and owns or licenses computerized data that includes personal information. Both require disclosure of a breach of the security of the system, following discovery or notification of the breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. An agency, person or business that maintains data it does not own must instead notify the owner or licensee immediately after discovery (1798.29(b) and 1798.82(b)), and both sections allow delay while a law enforcement agency determines that notice would impede a criminal investigation (subdivision (c)).

As enacted in 2002, personal information was an individual's first name or first initial and last name combined with a Social Security number, a driver's license or California identification card number, or an account or card number with the code or password that permits access, when either the name or the element was unencrypted; publicly available government-record information was excluded. Notice could be written, electronic under 15 U.S.C. 7001, or substitute notice when the cost would exceed $250,000, the affected class exceeded 500,000 or contact details were lacking, consisting of email, website posting and statewide media. An entity with its own timely notification procedures complied by following them.

The current section 1798.82 keeps that structure and extends it. Subdivision (h) now lists, alongside the original three elements, tax identification, passport, military and other government identification numbers, medical and health insurance information, unique biometric data used to authenticate a person (a photograph only if used for facial recognition), automated license plate recognition data and genetic data, and separately a username or email address with a password or security question and answer for an online account. Subdivision (j) adds notice routes for breaches of online credentials, including directing the person to change the password, and forbids notifying a breach of email credentials at the breached address.

Subdivision (d) prescribes the notice: plain language, the title Notice of Data Breach, the five headings, type no smaller than 10 point, and at minimum the entity's name and contact details, the types of personal information involved, the breach dates and the notice date, whether law enforcement delayed the notice, a general description of the incident, the credit reporting agencies' numbers when a Social Security or identification number was exposed and, when the notifying entity was the breach source, an offer of free identity theft prevention and mitigation services for not less than 12 months. A HIPAA covered entity that complies fully with section 13402(f) of the HITECH Act is deemed to satisfy subdivision (d) (1798.82(e)).

Timing and oversight changed with SB 446 (Hurtado), passed by the Senate 39-0 and signed by the Governor in October 2025. The section as updated on January 1, 2026 requires a business to disclose within 30 calendar days of discovery or notification of the breach (1798.82(a)(2)(A)), subject to the law enforcement and scope-of-breach delays, and to submit the sample notice for breaches affecting more than 500 residents to the Attorney General within 15 calendar days of notifying consumers (1798.82(f)). Section 1798.29 keeps the most-expedient-time standard for agencies and their Attorney General copy without a day count (1798.29(e)). The Attorney General takes submissions by online form and publishes a searchable list.

Key Elements

• Covered entities (1798.29 and 1798.82(a))

State agencies, and any person or business that conducts business in California and owns, licenses or maintains computerized data that includes personal information about a California resident.

• Breach of the security of the system (1798.82(g))

Unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information; good-faith acquisition by an employee or agent for the entity's purposes is excluded if the data are not misused.

• Personal information (1798.82(h) and (i))

Name plus Social Security, driver's license, state identification, tax, passport, military or other government identification numbers, financial account numbers with access codes, medical or health insurance information, unique biometric data, license plate recognition data or genetic data; or online credentials; public government-record information excluded.

• Timing (1798.82(a)(2) and (c))

Disclosure within 30 calendar days of discovery or notification, delayed only for the legitimate needs of law enforcement or to determine the scope of the breach and restore the integrity of the data system.

• Notice form and content (1798.82(d) and (j))

Notice of Data Breach title, five headings, 10-point type, the minimum contents, 12 months of identity theft prevention services when identification numbers are exposed; written, electronic or substitute notice, with special routes for online credentials.

• Attorney General copy and remedies (1798.82(f) and 1798.84)

A sample notice to the Attorney General within 15 calendar days when more than 500 residents are notified; a civil action for damages and an injunction for any customer injured by a violation of the title.

What does it cover?

The law applies to any state agency and to any person or business that conducts business in California and owns, licenses or maintains computerized data that includes personal information about California residents (1798.29 and 1798.82); the business need not be located in California. It covers computerized data only, and only the data elements listed in subdivision (h); publicly available government-record information falls outside it (1798.82(i)(1)). A HIPAA covered entity satisfies the notice-content rules by complying with section 13402(f) of the HITECH Act (1798.82(e)), and an entity with its own compliant notification procedures may follow them (1798.82(l)). Section 6 of the 2002 act preempts local rules on the same subject.

What are its objectives?

The Legislature set out its purpose in Section 1 of the 2002 act and in the text of sections 1798.29 and 1798.82.

Give California residents expeditious notice when their unencrypted personal information may have been acquired by an unauthorized person, so that identity theft victims can act quickly (Section 1(e) and 1798.82(a)).

Hold every state agency and every business that holds Californians' computerized personal information to the same disclosure duty, wherever the business is located (1798.29 and 1798.82).

Make the notice readable and complete through the Notice of Data Breach title, headings and minimum contents, and the 12-month identity theft prevention offer (1798.82(d)).

Fix the clock at 30 calendar days for businesses while preserving law enforcement and scope-of-breach delays (1798.82(a)(2) and (c)).

Give the Attorney General and the public visibility of larger breaches through the sample notice due within 15 calendar days (1798.82(f)) and the published list.

Framework in Context

SB 1386 is the model that later state breach-notification statutes followed, and its home title in the Civil Code, Customer Records (Title 1.81), also holds the civil remedies of section 1798.84. The section defers to federal health law for notice content: a HIPAA covered entity complying with HITECH section 13402(f) is deemed compliant with subdivision (d) (1798.82(e)). The California Attorney General administers the sample-notice submission and the public breach list, and the Legislature keeps revising the section, most recently through SB 446 (Hurtado) with the 30-day and 15-day deadlines reflected in the text updated on January 1, 2026. Organizations with national footprints treat section 1798.82 as the common denominator for notice timing and content.

Common Framework Mappings

Organizations map section 1798.82 to the security and privacy frameworks below so that one incident process produces the breach determination, the resident notice and the Attorney General copy alongside the evidence those frameworks expect.

Mapped frameworks include:

CIS Controls v8.1

GDPR

GLBA Safeguards Rule (16 CFR Part 314)

HIPAA (NIST SP 800-66 Rev. 2)

ISO 27001:2022

ISO 27018

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2