How fast must a company tell you about a data breach? (US)
Checked against official sources Nov 6, 2026
Short answer
It depends on the state. Washington requires notice to affected residents within 30 calendar days of discovering the breach, and California set the same 30-day limit in 2025. Both allow a delay requested by law enforcement or needed to find the scope of the breach and restore the system.
Washington
Under RCW 19.255.010, businesses must notify affected residents in the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered. If more than 500 Washington residents are affected, the Attorney General must be notified within the same 30 days.
California
Civil Code 1798.82, as amended in 2025 (SB 446), requires notice within 30 calendar days of discovery or notification of the breach. For breaches affecting more than 500 Californians, a sample notice goes to the Attorney General, which publishes the list.
How long it takes in practice
Our notification delay report measures, from Washington's public data, how many days organizations take between becoming aware of a breach and notifying the Attorney General. Many take far longer than 30 days; the law's exceptions explain some of that.
Official sources
General information, not legal advice. Teollimi does not file claims or refer people to claims firms.