State Breach Notification Laws: 50-State Comparison and How to Track Deadlines

TL;DR

• All 50 states have data breach notification laws. They don’t agree on deadlines, covered data types, or what counts as a breach.
• California, New York, Florida, Colorado, and Washington all require notification within 30 days. HIPAA’s 60-day window is a floor, not a ceiling.
• California SB 446 (effective January 1, 2026) added a firm 30-day consumer deadline and a 15-day AG notification requirement for larger breaches.
• Over 90% of breach enforcement actions are multistate efforts. Missing one state’s deadline can trigger a coordinated multi-AG response.
• Build your incident response timeline around the most stringent applicable jurisdiction — not the most forgiving one.

The moment a breach is confirmed, clocks start running. Not one clock — potentially 50. Each with different deadlines, different definitions of “personal information,” different regulator contacts, and different penalty structures.

If you designed your breach response process around HIPAA’s 60-day window, you’ve probably been operating with a false sense of safety. Twenty states have shorter deadlines. Six states require notification in 30 days or less. And the trend since 2020 has been universally toward shorter timelines and larger penalties.

Here’s the practical map.

The Baseline: All 50 States Are Now Covered

As of 2026, every U.S. state has enacted a data breach notification law. The District of Columbia, Puerto Rico, and Guam have laws as well. There is no jurisdiction in the continental United States where a covered breach doesn’t trigger notification obligations.

The uniformity ends there. State laws diverge on:

• Notification deadlines (30 days to “without unreasonable delay”)
• What counts as personal information (some states include biometrics, account credentials, or medical information beyond HIPAA scope)
• What triggers the law (unauthorized acquisition vs. access vs. disclosure)
• Who must be notified (affected individuals, state AG, regulators, consumer reporting agencies)
• Format requirements (some states specify minimum content for notification letters)

The Notification Deadline Spectrum

Twenty-two states specify a numeric deadline for consumer notification. The rest use qualitative language — typically “without unreasonable delay” or “in the most expedient time possible.”

States with 30-Day Deadlines (Strictest Tier)

For NYDFS-regulated entities in New York, the window is even tighter: a separate 72-hour notification requirement applies for cybersecurity events under Part 500, independent of the state breach law.

States with 45-Day Deadlines

States with 60-Day Deadlines

States Using Qualitative Deadlines

The remaining 28 states use “without unreasonable delay,” “most expedient time possible,” or similar language. This sounds permissive. It isn’t.

Delay still needs documented justification — typically a law enforcement request to delay notification or ongoing forensic investigation that has not yet established scope.

The Federal Layer: HIPAA, GLBA, and How They Interact

HIPAA’s 60-Day Window

HIPAA requires covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates to notify affected individuals within 60 calendar days of discovering a breach. This is the federal baseline.

HIPAA explicitly does not preempt stricter state laws. The statute preserves state law where the state provides greater protections than HIPAA. This means:

• A California hospital with a HIPAA breach must notify affected patients within 30 days (under SB 446), not 60.
• A Colorado health plan must notify within 30 days regardless of HIPAA’s longer window.
• A Florida covered entity must notify within 30 days.

The practical rule: design your breach notification process around the fastest applicable state law, not HIPAA. Meeting the strictest applicable deadline satisfies all less-stringent requirements.

For breaches affecting 500 or more individuals, HIPAA also requires notice to the Secretary of HHS at the same time as individual notice, plus media notice where more than 500 residents of a state are affected. States like California and New York add their own AG notification requirements on top of this.

GLBA and Financial Institutions

The FTC’s Safeguards Rule notice requirement (effective May 13, 2024) requires non-bank financial institutions to notify the FTC within 30 days of discovering a breach involving 500 or more consumers. This requirement runs parallel to state law obligations — both must be satisfied.

NYDFS-regulated financial entities face the most layered obligation stack: the 72-hour Part 500 cybersecurity event notice, the 30-day New York state breach law, the FTC Safeguards Rule notification (if applicable), and any federal prudential regulator requirements.

What Changed in 2026

California SB 446 (Effective January 1, 2026)

California’s existing breach law (Civil Code §1798.82) already required “expedient” notification. SB 446 made it concrete. Effective January 1, 2026:

• 30-day deadline: Covered entities must notify affected California residents within 30 calendar days of discovering a reportable breach.
• AG notification: If the breach affects more than 500 California residents, the entity must provide a sample copy of the consumer notification to the California Attorney General within 15 days of notifying affected individuals.
• Broader data scope: The law continues to cover a wide range of personal information, including account credentials, biometric data, and medical information.

For any company with California customers — which is nearly every national consumer-facing business — SB 446 effectively tightens your external deadline to 30 days from discovery.

Oklahoma SB 626 (Effective January 1, 2026)

Oklahoma substantially revised its breach notification statute effective January 1, 2026. Key changes align Oklahoma’s law more closely with the strictest state frameworks, including expanded definitions of personal information and clearer notification requirements.

The Enforcement Reality: State AGs Are Your Primary Risk

The CFPB is constrained under the current administration. Federal privacy enforcement has slowed. But state attorneys general are moving in the opposite direction.

Over 90% of data breach enforcement actions are now brought as multistate collaborative efforts — multiple AGs coordinating investigation, demands, and settlement terms. When you miss a breach notification deadline in one state, you’re rarely dealing with just one state’s AG.

Recent enforcement examples illustrate the stakes:

• NYDFS $2 million fine: For failure to notify within 72 hours of a cybersecurity event as required under Part 500. The cybersecurity regulation notification requirement is separate from — and stricter than — the state breach law.
• Massachusetts AG $795,000 settlement: Against a property management company that unlawfully delayed required data breach notifications to Massachusetts residents.
• New York civil penalties: Up to $5,000 or $20 per affected individual (whichever is greater), capped at $250,000 per breach event.
• California: Injured customers can sue for damages under Civil Code §1798.84; the CCPA adds statutory damages of $107 to $799 per consumer per incident (CPI-adjusted January 1, 2025).

The multistate enforcement mechanism is important to understand. Because most companies operate in multiple states, a breach affecting residents in California, New York, and Texas simultaneously triggers notification obligations in all three. If your timeline satisfies Texas (60 days) but not California (30 days), the California AG can act — and will likely coordinate with other AGs who receive similar complaints.

How to Build a Notification-Ready Incident Response Process

The standard incident response lifecycle — detect, contain, investigate, remediate, notify — has a timing problem. Many organizations don’t activate their legal and compliance notification process until the technical investigation is complete. At that point, you may already be inside a 30-day window with no documentation, no draft notifications, and no AG contacts on file.

A notification-ready process activates much earlier.

The First 24 Hours: Activate, Don’t Wait

Within 24 hours of confirming a potential breach (even before scope is established):

1. Activate your breach counsel — attorney-client privilege is essential to protect investigation communications
2. Start the jurisdiction clock — begin mapping which states’ residents may be affected based on what you know now
3. Open your notification tracking log — document discovery date, time, and who was informed
4. Pull your state deadline matrix — identify the most stringent applicable deadline

You don’t need to know the full scope to know that you’re inside a 30-day window in California. That determination should happen on day one.

The Jurisdiction Matrix: Build It Before You Need It

Every organization with multi-state operations should maintain a pre-built jurisdiction matrix covering:

This document belongs in your incident response plan alongside your escalation tree and vendor contacts. Hunting for each state’s law during an active incident is a way to miss deadlines.

Pre-Draft Your Notification Templates

State laws vary in what they require notification letters to include. Common requirements:

• Description of what happened
• Types of information involved
• Steps taken to protect individuals
• Steps affected individuals can take to protect themselves
• Contact information for questions

Some states (California, Maryland) require specific content elements. Others (Delaware) require credit monitoring offers for certain breach types. Pre-drafting template language for your most likely breach scenarios — credential theft, unauthorized database access, ransomware with confirmed data exfiltration — means you’re filling in variables during an incident, not writing from scratch.

Law Enforcement Delay: Know the Rules

Most state breach laws include a provision allowing notification to be delayed at the request of law enforcement if notification would impede a criminal investigation. This exception is narrow:

• It requires an actual law enforcement request (not an assumption that law enforcement might prefer delay)
• It applies only as long as law enforcement requests the delay — and law enforcement will specify the timeframe
• It does not eliminate the notification obligation; it defers it
• It does not apply to NYDFS’s 72-hour cybersecurity event notification requirement

Document any law enforcement delay request in writing. If law enforcement contacts you orally, confirm in writing immediately.

How to Stay Current as Laws Change

State breach laws have been amended or expanded in every year since 2018. Maintaining a static jurisdiction matrix is not enough. Build a monitoring process:

Subscription resources:

• IAPP U.S. State Breach Notification Chart — updated as laws change
• NCSL Security Breach Notification Laws tracker — the authoritative legislative tracking source
• Perkins Coie Breach Notification Chart — maintained by privacy counsel with practice-level updates

Internal triggers for matrix review:

• January 1 of each year — review for laws taking effect with the new year
• After any multistate enforcement action in your industry
• When expanding operations into a new state

The incident response plan template at this site includes a breach notification tracking section, but every team should build a living jurisdiction matrix that gets reviewed at least annually.

So What Does This Mean for Your Program?

Breach notification compliance is a timing discipline more than a legal knowledge problem. Most organizations know notifications are required. The failures happen because:

1. The legal team doesn’t activate until the technical investigation is “done” — by which point the 30-day clock is already more than halfway expired
2. The jurisdiction matrix doesn’t exist or is out of date, so the team wastes time during the incident figuring out which deadlines apply
3. Notification templates aren’t pre-drafted, so drafting consumes the time that should go to review and approval
4. The AG notification requirement is missed because the team focused only on consumer notification

Fix these four things and you’re ahead of most of the enforcement actions that have gone badly for organizations.

The Incident Response & Breach Notification Kit includes a State Reference for 54 jurisdictions (50 states, DC, Puerto Rico, Guam and the U.S. Virgin Islands): consumer deadline and when the clock starts, regulator notice and timing, credit bureau thresholds and a source link on every row, verified 09/30/2026, including California’s 30-day deadline under SB 446. The Breach Notification tab calculates each state’s deadlines for an incident, and the customer notice template uses California’s required headings.

Sources:

• Privacy Rights Clearinghouse: Data Breach Notification Laws — 50-State Survey (2026 Edition)
• NCSL: Summary Security Breach Notification Laws
• Alston & Bird: Key Breach Notification Updates in California and Oklahoma for 2026
• HHS.gov: HIPAA Breach Notification Rule
• Skadden: State Attorneys General May Fill Enforcement Void Left by Shift in Federal Priorities