SB 446: Data breaches: customer notification.

Official summary

Legislative Counsel’s Digest (official, as of the latest version). Written by nonpartisan legislative staff; reproduced verbatim.

Existing law requires an individual or a business that conducts business in California, and that owns or licenses computerized data that includes personal information, to disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was compromised, as specified, and requires that disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

This bill would require that data breach disclosure to be made within 30 calendar days of discovery or notification of the data breach but would authorize an individual or business to delay the disclosure to accommodate the legitimate needs of law enforcement, as specified, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Existing law also requires an individual or business that is required to issue the security breach notification described above to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General.

This bill would require that submission to the Attorney General to be made within 15 calendar days of notifying affected consumers of the security breach.

Sponsors

Sponsors by party (alphabetical): Democratic 1

“Support” is shown only as formal sponsorship recorded by the legislature. Roll-call votes are available on the official bill page.

Recent official actions

1. October 3, 2025Chaptered by Secretary of State. Chapter 319, Statutes of 2025.
2. October 3, 2025Approved by the Governor.
3. September 3, 2025Enrolled and presented to the Governor at 11 a.m.
4. August 28, 2025In Senate. Ordered to engrossing and enrolling.
5. August 28, 2025Read third time. Passed. (Ayes 74. Noes 0. Page 2776.) Ordered to the Senate.
6. August 21, 2025Read second time. Ordered to consent calendar.
7. August 20, 2025From committee: Do pass. Ordered to consent calendar. (Ayes 15. Noes 0.) (August 20).
8. July 9, 2025From committee: Do pass and re-refer to Com. on APPR. with recommendation: To consent calendar. (Ayes 12. Noes 0.) (July 8). Re-referred to Com. on APPR.
9. June 25, 2025From committee: Do pass and re-refer to Com. on JUD. with recommendation: To consent calendar. (Ayes 15. Noes 0.) (June 24). Re-referred to Com. on JUD.
10. June 5, 2025Referred to Coms. on P. & C.P., JUD., and APPR.
11. May 28, 2025In Assembly. Read first time. Held at Desk.
12. May 28, 2025Read third time. Passed. (Ayes 39. Noes 0. Page 1297.) Ordered to the Assembly.