Privacy & Cybersecurity Law Blog

On October 3, 2025, Governor Gavin Newsom signed SB-446 into law, which updates California’s data breach notification law to set specific individual and regulator notification timelines. The law previously required notification to both individuals and the California Attorney General (where required) “in the most expedient time possible and without unreasonable delay.” SB-446 amends the law to now require businesses and organizations to notify (1) affected California residents within 30 calendar days of discovering (or being notified of) a data breach affecting their personal information, and (2) the California Attorney General within 15 calendar days of notifying affected consumers (for breaches affecting more than 500 California residents).