How long does a company have to notify me of a data breach in Washington?

Under Washington law, companies must notify affected residents within 30 days of discovering a breach. Failure to notify within this window is itself a violation of state law.

Washington Attorney General Database

Washington Data Breach Notification Letters

Q: What is the Washington data breach notification law?

Washington data breaches are governed by the My Health MY Data Act (MHMD) & Washington Consumer Protection Act (CPA). Washington enacted the My Health MY Data Act in 2023 — the strongest health data privacy law in the country outside of HIPAA. MHMD covers consumer health data not protected by HIPAA and provides a private right of action with no cap on damages. The Washington CPA also provides a private right of action for data security violations.

We are tracking 19+ companies that sent data breach notification letters to Washington residents and reported to the Washington Attorney General. If you received a notice, you may qualify for compensation — at no cost to you.

19+

Active Cases

30 days

Notification Deadline

Upfront Cost to You

Washington Data Breach Law

My Health MY Data Act (MHMD) & Washington Consumer Protection Act (CPA)

Washington enacted the My Health MY Data Act in 2023 — the strongest health data privacy law in the country outside of HIPAA. MHMD covers consumer health data not protected by HIPAA and provides a private right of action with no cap on damages. The Washington CPA also provides a private right of action for data security violations.

Notification Window

30 days

Available Damages

Unlimited actual damages under MHMD private right of action; treble damages possible under CPA

Are You Eligible to File a Claim?

Washington residents with health data exposed have exceptionally strong protections under MHMD's private right of action — they can sue directly without going through the AG. This is one of the most powerful breach remedies in the country.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a Washington resident or your data was held by a Washington company

You do not need to prove financial loss to qualify

Companies That Sent Notification Letters in Washington

Each company below is an active case in our tracker. Click any company row to open its full case page — what information was exposed, the AG filing date, and how to start a free claim review.

OneDigital Investment Advisors LLC

Reported Apr 2026Full Name, Social Security Number +6 more

DermCare Management

Reported Apr 2026Full Name, Date of Birth +7 more

Texas Tech University Health Sciences Center

Reported Apr 2026Full Name, Date of Birth +6 more

David Evans Enterprises, Inc.

Reported Apr 2026Full Name, Social Security Number +6 more

Pediatric Products, LLC

Reported Apr 2026Full Name, Date of Birth +6 more

The Trustees of the University of Pennsylvania

Reported Apr 2026Full Name, Date of Birth +6 more