Cybersecurity Policy Report, Lawmakers Advance California Bill on Data Breach Disclosure Requirements, (May 29, 2025)
The California state Senate has passed a bill that would amend state law regarding data breaches to require breaches to be disclosed within 30 calendar days of discovery or notification of the data breach.
SB 446 would authorize a business to delay the disclosure to accommodate the legitimate needs of law enforcement “or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.”
Existing state law requires an individual or business that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the attorney general.
This bill would require that submission to the attorney general be made within 15 calendar days of discovery or notification of the security breach.
The bill (S.B. 446, Reg Sess.) is sponsored by Sen. Melissa Hurtado (D.).
News: StateLegislation DataBreach DataSecurity