The Letter About Your Information
Civ. Code 1798.82 — notice within 30 calendar days, and a sample to the Attorney General above 500
In California, the disclosure of a breach of the security of a data system that the section requires is made within 30 calendar days of discovery or notification of the breach, subject to the exceptions the section sets, such as a delay a law enforcement agency asks for.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldEach affected resident | When, as the section puts itWithin 30 calendar days of discovery or notification |
| Who is toldThe Attorney General, if more than 500 California residents are notified from a single breach | When, as the section puts itA single sample copy of the notice, within 15 calendar days of notifying them |
| Who is toldSubstitute notice, where the section allows it | When, as the section puts itIncludes posting the notice conspicuously on the business's website for a minimum of 30 days |
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed California attorney.
Sources for this section (1)
- Civ. Code 1798.82 — Disclosure of a breach of security of a data system
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed California attorney.