How long does a company have to notify me of a data breach in California?

Under California law, companies must notify affected residents within 72 hours (HIPAA entities); most expedient time for others of discovering a breach. Failure to notify within this window is itself a violation of state law.

California Attorney General Database

California Data Breach Notification Letters

Q: What is the California data breach notification law?

California data breaches are governed by the California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA). California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

We are tracking 50+ companies that sent data breach notification letters to California residents and reported to the California Attorney General. If you received a notice, you may qualify for compensation — at no cost to you.

50+

Active Cases

72 hours (HIPAA entities); most expedient time for others

Notification Deadline

Upfront Cost to You

California Data Breach Law

California Consumer Privacy Act (CCPA) & Consumer Privacy Rights Act (CPRA)

California has the strongest consumer data privacy laws in the nation. Under the CCPA and CPRA, California residents are entitled to statutory damages of $100 to $750 per consumer per incident — without having to prove any actual financial harm. California also requires notification within 72 hours for regulated entities.

Notification Window

72 hours (HIPAA entities); most expedient time for others

Available Damages

$100–$750 per consumer per incident (statutory, no proof of harm needed)

Are You Eligible to File a Claim?

California residents have the broadest data breach rights in the country. You can sue even without proving financial harm — the exposure of your data alone is enough to qualify for statutory damages.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a California resident or your data was held by a California company

You do not need to prove financial loss to qualify

Companies That Sent Notification Letters in California

Each company below is an active case in our tracker. Click any company row to open its full case page — what information was exposed, the AG filing date, and how to start a free claim review.

Blue Shield of California

Reported Apr 2025Full Name, Date of Birth +6 more

Omni Healthcare Financial Holdings, LLC

Reported Apr 2025Full Name, Date of Birth +6 more

Kelly & Associates Insurance Group, Inc.

Reported Apr 2025Full Name, Social Security Number +6 more

Newport Harbor Pathology Medical Group, Inc. d/b/a Orange County Medical Group Pathology d/b/a Mission Laguna Pathology Medical Group d/b/a Barr Dermatopathology

Reported Apr 2025Full Name, Date of Birth +6 more

Landmark Admin, LLC

Reported Apr 2025Full Name, Social Security Number +6 more

Lemonade, Inc.

Reported Apr 2025Full Name, Date of Birth +7 more