Breach and Fine Tracker
Menu

Breach notification

US state breach notification laws explained

Last checked 24 October 2026 · 7 sources

Short answer

All 50 US states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring notice to individuals when personal information is breached, according to the NCSL 1. The laws differ on deadlines, harm tests and who else must be told. Washington, Florida and New York set 30-day outer limits 2,3 4. California requires a sample notice to the Attorney General when more than 500 residents are notified 5. Federal rules for health data and listed companies sit on top 6,7.
Jurisdictions with laws
50 states, DC, Guam, Puerto Rico, Virgin Islands 1
Washington deadline
No more than 30 calendar days 2
Florida deadline
No later than 30 days 3
New York deadline
Within 30 days of discovery 4
California AG notice
Sample copy if more than 500 residents 5

Every state has its own law

The National Conference of State Legislatures (NCSL) says every state has a law requiring private businesses, and in most states government entities, to notify individuals of breaches of personally identifiable information 1. Its summary page was last updated on 17 January 2022 1.

  • Who must comply, such as businesses, data brokers and government entities 1.
  • What counts as personal information, such as a name combined with a Social Security number or account number 1.
  • What counts as a breach, such as unauthorized acquisition of data 1.
  • Notice rules on timing, method and recipients 1.
  • Exemptions, such as for encrypted information 1.

Four state laws side by side

StateNotice to individualsNotice to state officialsPenalty
California 5Duty under Civil Code 1798.82(a). The AG page read gives no day count 5Sample copy to the Attorney General if more than 500 residents are notified 5Not stated on the AG page read 5
Washington 2No more than 30 calendar days after discovery 2Attorney General within 30 days if more than 500 residents are affected 2Not set in RCW 19.255.010 2
Florida 3No later than 30 days after the breach is determined 3Department of Legal Affairs within 30 days if 500 or more residents, with 15 more days for good cause 3Up to US$500,000 per breach 3
New York 4Within 30 days of discovery 4Attorney General, Department of State and State Police 4Greater of US$5,000 or up to US$20 per failed notice, the latter capped at US$250,000 4

Harm tests and encryption

Some states drop the notice duty where harm is unlikely. Washington does not require notice when the breach is not reasonably likely to subject consumers to a risk of harm 2. Florida does not require it when the entity documents that the breach is unlikely to cause identity theft or financial harm 3.

Encryption is a common exemption 1. Washington still requires notice for secured data when the key or other means to decipher it was acquired 2.

Credit bureaus, penalties and lawsuits

Florida requires notice to nationwide consumer reporting agencies when more than 1,000 people must be notified 3. New York sets the threshold at more than 5,000 New York residents 4.

Florida sets civil penalties of US$1,000 per day for the first 30 days, then US$50,000 for each later 30-day period up to 180 days, with a cap of US$500,000 3. Penalties apply per breach, not per person 3. The Florida section states that it does not establish a private cause of action 3.

California's Attorney General publishes breach notices it receives, and residents can search them 5.

Federal rules on top of state law

Health plans, health care providers and their business associates follow the HIPAA Breach Notification Rule, which sets a 60-day outer limit 6. Public companies must disclose material cybersecurity incidents on Form 8-K within four business days of deciding they are material, under an SEC rule adopted on 26 July 2023 7.

Common questions

Does every US state have a data breach law?

Yes. The NCSL says all 50 states, DC, Guam, Puerto Rico and the Virgin Islands have such laws 1.

What is the deadline in Washington State?

No more than 30 calendar days after discovery, with exceptions for law enforcement requests and for time to determine scope 2.

Can consumers sue under Florida's breach law?

Section 501.171 states that it does not establish a private cause of action 3.

Where can I search California breach notices?

The California Attorney General publishes notices submitted to its office 5.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

  1. NCSL: Security Breach Notification Laws (updated 17 January 2022)
  2. Washington State Legislature: RCW 19.255.010
  3. Florida Legislature: Florida Statutes 501.171, Security of confidential personal information
  4. New York State Senate: General Business Law Section 899-AA
  5. State of California Department of Justice, Office of the Attorney General: Data Security Breach Reporting
  6. HHS: Breach Notification Rule
  7. SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (26 July 2023)

Related