How long does a company have to notify me of a data breach in California?

Under California law, companies must notify affected residents within 72 hours (HIPAA entities); most expedient time for others of discovering a breach. Failure to notify within this window is itself a violation of state law.

California Attorney General Database

California Data Breach Notification Letters

Q: What is the California data breach notification law?

California data breaches are governed by the California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA). California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

We are tracking 26+ companies that sent data breach notification letters to California residents and reported to the California Attorney General. If you received a notice, you may qualify for compensation — at no cost to you.

26+

Active Cases

72 hours (HIPAA entities); most expedient time for others

Notification Deadline

Upfront Cost to You

California Data Breach Law

California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA)

California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

Notification Window

72 hours (HIPAA entities); most expedient time for others

Available Damages

$100–$750 per consumer per incident (statutory, no proof of harm needed)

Are You Eligible to File a Claim?

California residents have the broadest data breach rights in the country. You can sue even without proving financial harm — the exposure of your data alone is enough to qualify for statutory damages.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a California resident or your data was held by a California company

You do not need to prove financial loss to qualify

Companies That Sent Notification Letters in California

Each company below is an active case in our tracker. Click any company row to open its full case page — what information was exposed, the AG filing date, and how to start a free claim review.

The Phia Group, LLC

Reported May 2026Full Name, Social Security Number +6 more

City of Port Hueneme

Reported May 2026Full Name, Social Security Number +6 more

Frost Bank

Reported May 2026Full Name, Social Security Number +6 more

Sacramento County

Reported May 2026Full Name, Social Security Number +6 more

ERMI LLC

Reported May 2026Full Name, Date of Birth +8 more

Nickey Kehoe

Reported May 2026Full Name, Email Address +6 more