California Sets 30 Day Deadline for Data Breach Notifications

California’s breach notification obligations are tightening, with Governor Gavin Newsom signing SB 446 to set clear timelines. Under the new rules, businesses must notify affected individuals within 30 calendar days of discovering or being notified of a data breach, subject to limited flexibility for legitimate law enforcement purposes or to determine the full scope of the incident.

For breaches affecting more than 500 California residents, the California Attorney General must be notified within 15 calendar days of notifying affected consumers. The law takes effect on 1 January 2026, giving organisations time to prepare for the updated requirements. These changes were outlined by Joseph Lazzarotti of JacksonLewis, and readers are directed to read more at Workplace Privacy, Data Management & Security Report according to Workplace Privacy, Data Management & Security Report.