CA SB 1386

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-01-01 SB 446 takes effect – 30-day notice to residents and 15-day copy to the Attorney General
2. 2025-10-03 SB 446 approved by the Governor (Stats. 2025, ch. 319)
3. 2003-07-01 SB 1386 breach disclosure duty becomes operative

1. 2026-01-01
   Civil Code 1798.82, as amended by SB 446 (2025) AmendmentCurrent text

   SB 446 (Stats. 2025, ch. 319) requires notice to residents within 30 calendar days of discovering a breach and the sample copy to the Attorney General within 15 days. source

   More

   • The 30-day deadline may be delayed for the legitimate needs of law enforcement or as necessary to determine the scope of the breach and restore the integrity of the system.
   • The Attorney General copy is due within 15 calendar days of notifying affected consumers when more than 500 California residents are notified.
2. 2021-10-05
   AB 825 (2021) – genetic data Amendment

   AB 825 (Stats. 2021, ch. 527), approved on 5 October 2021, added genetic data to the personal information covered by the breach and security provisions. source

3. 2019-10-11
   AB 1130 (2019) – biometric and ID numbers Amendment

   AB 1130 (Stats. 2019, ch. 750) added unique biometric data and tax, passport, military and other government ID numbers to the definition of personal information. source

4. 2011-08-31
   SB 24 (2011) – notice content and AG copy Amendment

   SB 24 (Stats. 2011, ch. 197) set content requirements for breach notices and required a sample copy to the Attorney General for breaches notified to more than 500 residents. source

5. 2002-09-25
   SB 1386 (2002) Major version

   SB 1386 (Stats. 2002, ch. 915), operative 1 July 2003, required agencies and businesses to disclose breaches of unencrypted personal information to California residents. source

Anyone doing business in California who owns, licenses or maintains computerized personal information about California residents.

Owners and licensees

Must notify each California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted data was taken together with the key. source

Service providers

A business that maintains data it does not own must notify the owner or licensee immediately following discovery of the breach. source

Personal information

A name with an SSN, government ID number, financial account with access code, medical or health insurance information, biometric data, ALPR data or genetic data; or a username or email with its password or security answer. source

HIPAA entities

A HIPAA covered entity that fully complies with HITECH section 13402(f) is deemed to meet the notice-content requirements, but not the rest of the section. source

The business notifies residents itself within 30 days, using the prescribed notice format, and sends a sample copy to the Attorney General for breaches over 500 residents.

Deadline

Within 30 calendar days of discovery or notification of the breach, subject to delays for law enforcement or to determine the scope of the breach. source

Notice format

Titled "Notice of Data Breach", in plain language and at least 10-point type, with headings such as What Happened and What Information Was Involved; a model form is provided. source

Identity protection

If the business was the source of a breach exposing an SSN or government ID number, it must offer identity theft prevention and mitigation services free for at least 12 months. source

Attorney General

For a breach notified to more than 500 California residents, a single sample notice must be submitted electronically within 15 calendar days of notifying consumers. source

Reasonable security

Businesses holding personal information about California residents must also maintain reasonable security procedures and require them of non-affiliated recipients by contract. source

Injured customers can sue for damages and violations can be enjoined; consumers can also claim statutory damages when a breach results from unreasonable security.

Damages

Any customer injured by a violation of the title may bring a civil action for damages. source

Injunction

Any business that violates, proposes to violate or has violated the title may be enjoined. source

1. Law text Civil Code 1798.82 – Breach of security notification
2. Law text Civil Code 1798.81.5 – Reasonable security procedures
3. Law text Civil Code 1798.84 – Remedies
4. Law text Civil Code 1798.150 – Personal information security breaches (CCPA private action)
5. Law text SB 446 (2025), chaptered text

1. NY SHIELD Act

   New York's law also notifies residents within 30 days but covers mere access, not only acquisition, and adds a statutory data security programme duty.

2. TX BC 521

   Texas allows up to 60 days for notice to individuals and requires an Attorney General report within 30 days for breaches of 250 or more Texans.

3. CA SB 327

   California's connected-device law sets security features for devices; the breach law sets what happens after personal data is breached.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CA SB 1386 (RSS)