Cybersecurity Policy Report, Gov. Newsom Signs Bill to Require Prompt Notification of Data Breaches, (Oct 6, 2025)
California Gov. Gavin Newsom (D.) has signed into law a bill to require data breaches to be disclosed within 30 calendar days of discovery or notification of the data breach.
Current law requires entities that experience a data breach affecting more than 500 residents to notify both the affected individuals and the attorney general. However, the statute does not specify a fixed deadline for when these notifications must occur.
SB 446 requires that consumers be notified of a data breach within 30 days of its discovery and mandates submission of notices affecting more than 500 Californians. The new law will also require that submission to the attorney general be made within 15 calendar days of discovery or notification of the security breach.
“Cybersecurity breaches continue to threaten the personal and financial security of Californians, exposing sensitive data and leaving individuals vulnerable to identity theft and fraud. While existing law requires entities to report data breaches affecting more than 500 residents, it lacks a specific deadline for disclosure. As a result, affected individuals may not be informed for months—or even a year or more later—delaying their ability to take preventive measures,” said Sen. Melissa Hurtado (D.), sponsor of the bill (S.B. 446, Reg Sess.).
Sen. Hurtado continued, “By closing a critical loophole in California’s data protection laws, SB 446 upholds transparency and accountability while ensuring that residents are not left in the dark about threats to their data. Californians deserve the right to act swiftly when their personal information is compromised, and this bill provides the necessary framework to protect them.”
News: StateLegislation DataBreach