ShareAndGoShareAndGo

Data breach notification

California data breach notification law

California Civil Code § 1798.82 governs disclosure of a breach of customer records.

It gives a 30 calendar day deadline for telling residents and asks for a sample copy of the notice to go to the Attorney General when more than 500 Californians are affected.

The deadline in § 1798.82

A business must disclose a breach to a California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The section as currently served says that disclosure "shall be made within 30 calendar days of discovery or notification of the data breach."

Delay is allowed for law enforcement, or as necessary to determine the scope of the breach. Teams that need the extra time should be ready to explain which of those reasons applied.

What counts as personal information

The core definition is a first name or first initial and last name combined with one or more data elements, when either the name or the elements are not encrypted.

CategoryListed in § 1798.82
Identity numbersSocial Security number; driver's license, state ID, tax ID, passport, military ID or other government ID number
FinancialAccount or card number with any required code or password
HealthMedical information and health insurance information
Body and genesUnique biometric data and genetic data
VehiclesData collected through an automated license plate recognition system
Online accountsA username or email address with a password or security question and answer that would permit access to an online account

The list reaches automated license plate recognition data and genetic data, so it is worth reading item by item.

The Attorney General's copy

A business that must notify more than 500 California residents as a result of a single breach electronically submits a single sample copy of the notice to the Attorney General. The copy excludes any personally identifiable information and is due within 15 calendar days of notifying affected consumers.

No harm test, and a narrow encryption rule

Section 1798.82 has no risk-of-harm exception. If unencrypted personal information was acquired, the duty applies, and encrypted data is covered only where the key or credential was acquired too.

The notice itself must be titled "Notice of Data Breach" and use set headings.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

In each room the watermark is a setting that starts on, and a team can switch it off where it is not wanted. A six-digit code sent to the reader's email confirms the address, and no account is needed. The chained log covers views, uploads, downloads, invitations and changes, and it exports as CSV, so a team can sort readers by file and date in minutes instead of rebuilding the picture from email threads.

California FAQ

Does California allow a no-harm exception?
No. No risk-of-harm exception appears in § 1798.82.
When is the sample copy due?
Within 15 calendar days of notifying affected consumers, where more than 500 California residents were notified for a single breach.
Are online logins personal information?
Yes. A username or email address with a password or security question and answer that would permit access to an online account is listed.
Can the 30 days be extended?
The section allows delay for law enforcement or as necessary to determine the scope of the breach.

Checked

Checked against California's published law on November 2, 2026. This is general information, not legal advice.

Related

Breach notification laws by state

Breach notice laws for every jurisdiction.

ShareAndGo vs DataRooms.com

See how two data rooms compare.

ShareAndGo

ShareAndGo home.