Executing California Breach Notification

Overview

California was the first US state to enact a data breach notification law (SB 1386, 2003). Cal. Civ. Code §1798.82 requires any person, business, or state agency that owns or licenses computerized data containing personal information to notify California residents when unencrypted personal information has been (or is reasonably believed to have been) acquired by an unauthorized person. The California Attorney General must be notified when more than 500 California residents are affected.

Covered Data Elements — Cal. Civ. Code §1798.81.5(d)

A breach notification is triggered when an individual's first name or first initial and last name is combined with any of the following unencrypted or unredacted data elements: