Free tool
State breach notification lookup
Select the affected resident states and compare deadlines, notice recipients, regulator portals, consumer-reporting-agency thresholds, statutes, and verification dates. No email gate.
This tells you the clock. Policywright writes the plan that starts it.
Select states
Choose every state where affected residents may live. The comparison sorts by the shortest stated deadline first.
| State | Deadline | Who must be notified | Regulator portal | CRA threshold | Statute |
|---|---|---|---|---|---|
| California | Within 30 calendar days of discovery or notification of the breach, subject to law-enforcement delay or time needed to determine scope and restore integrity; AG sample notice within 15 calendar days after notifying consumers when more than 500 residents are affected. | Affected California residents whose covered personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Submit a sample breach notice to the California Attorney General when notice is required for more than 500 California residents. | California Attorney General | California Civil Code § 1798.82 requires consumer-reporting-agency contact information in certain notices involving Social Security, driver license, or California identification card numbers; review the statute for the exact notice content. | Cal. Civ. Code § 1798.82 |
California
StatuteCal. Civ. Code § 1798.82
DeadlineWithin 30 calendar days of discovery or notification of the breach, subject to law-enforcement delay or time needed to determine scope and restore integrity; AG sample notice within 15 calendar days after notifying consumers when more than 500 residents are affected.
ResidentsAffected California residents whose covered personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
RegulatorCalifornia Attorney General
AG / regulator noticeSubmit a sample breach notice to the California Attorney General when notice is required for more than 500 California residents.
CRA thresholdCalifornia Civil Code § 1798.82 requires consumer-reporting-agency contact information in certain notices involving Social Security, driver license, or California identification card numbers; review the statute for the exact notice content.
Consumer triggerCalifornia notices must use plain language and include specific headings and content; businesses notifying more than 500 California residents must submit a sample notice to the Attorney General within 15 calendar days after notifying consumers.
Last verified 2026-08-12.
State pages
AlabamaAlaskaArizonaArkansasCaliforniaColoradoConnecticutDelawareDistrict of ColumbiaFloridaGeorgiaHawaiiIdahoIllinoisIndianaIowaKansasKentuckyLouisianaMaineMarylandMassachusettsMichiganMinnesotaMississippiMissouriMontanaNebraskaNevadaNew HampshireNew JerseyNew MexicoNew YorkNorth CarolinaNorth DakotaOhioOklahomaOregonPennsylvaniaRhode IslandSouth CarolinaSouth DakotaTennesseeTexasUtahVermontVirginiaWashingtonWest VirginiaWisconsinWyoming
Source base
Each state page lists its official statute and regulator source links. This tool renders only fields present in the verified state dataset.
- Code of Alabama § 8-38-5
- Code of Alabama § 8-38-6
- Code of Alabama § 8-38-8
- Alabama Attorney General data breach notification form
- Alaska Statutes, AS 45.48.010–45.48.090
- Alaska Department of Law consumer laws: Personal Information Protection Act
- Alaska State Legislature HB 65 Personal Information Protection Act amendments
- Arizona Revised Statutes § 18-552
- Arizona Attorney General data privacy and data breach reporting
- Arizona Attorney General data breach notification FAQ
- Arkansas State Legislature Act 1526 of 2005
- Arkansas State Legislature Act 1030 of 2019
- Arkansas Attorney General contact and data breach reporting
- California Civil Code § 1798.82
- California Attorney General data-breach reporting
- California Attorney General breach sample submission portal
- Colorado Attorney General consumer data protection laws FAQ
- Colorado Attorney General data breach reporting form
- Connecticut General Statutes § 36a-701b
- Connecticut Attorney General data breach reporting
- Connecticut Attorney General data breach submission form
- Delaware Code Title 6, Chapter 12B
- Delaware DOJ data security breaches guidance
- Delaware DOJ data security breach database
FAQ
Is this lookup legal advice?
No. It is a source-linked lookup for planning and triage. Breach-notification decisions should be reviewed with qualified counsel.
Can I use more than one state?
Yes. Select every state where affected residents may live, and the comparison table sorts by the shortest stated deadline first.
Does the PDF require an email address?
No. The PDF download is free and does not require an email gate.
Policywright is a configurable template product, not a law firm and not legal advice. State breach deadlines and legal reliance should be reviewed with qualified counsel before launch or use.