How long does a company have to notify me of a data breach in California?

Under California law, companies must notify affected residents within 72 hours (HIPAA entities); most expedient time for others of discovering a breach. Failure to notify within this window is itself a violation of state law.

California Attorney General Database

California Data Breach Lawsuits

Q: What is the California data breach notification law?

California data breaches are governed by the California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA). California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

We are tracking 50+ active data breach cases reported to the California Attorney General. If your information was exposed, you may qualify for compensation — at no cost to you.

50+

Active Cases

72 hours (HIPAA entities); most expedient time for others

Notification Deadline

Upfront Cost to You

California Data Breach Law

California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA)

California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

Notification Window

72 hours (HIPAA entities); most expedient time for others

Available Damages

$100–$750 per consumer per incident (statutory, no proof of harm needed)

Are You Eligible to File a Claim?

California residents have the broadest data breach rights in the country. You can sue even without proving financial harm — the exposure of your data alone is enough to qualify for statutory damages.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a California resident or your data was held by a California company

You do not need to prove financial loss to qualify