Bill > SB446

This bill amends California's existing data breach notification law by establishing specific timelines and requirements for businesses and individuals who experience a data breach involving personal information. The bill mandates that organizations must disclose a data breach to affected California residents within 30 calendar days of discovering or being notified about the breach, with allowances for delay if law enforcement needs to investigate or if the organization needs time to determine the breach's scope and restore data system integrity. For breaches affecting more than 500 California residents, the bill requires organizations to submit a sample copy of the breach notification (without personally identifiable information) to the Attorney General within 15 calendar days of notifying consumers. The notification must be written in plain language, use a specific format with clear headings like "What Happened?" and "What Information Was Involved?", and include details such as the type of personal information compromised, the date or estimated date of the breach, and contact information. For certain types of breaches involving sensitive information like social security numbers, the organization must also offer free identity theft prevention services for at least 12 months. The bill maintains existing definitions of personal information and provides guidelines for how notifications can be delivered, including written, electronic, or alternative "substitute" notice methods.

Budget and Finance, Business and Industry, Justice

https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB446