Data breach notification
Washington's breach notice rules are in RCW 19.255.005 (definitions) and RCW 19.255.010 (the duty), cited as Wash. Rev. Code §§ 19.255.005, 19.255.010.
Residents and the attorney general both have a 30-day limit.
Residents must be told "in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered."
A business that must notify "more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered."
Both run from discovery, so they end on the same day.
Washington's list is long. With a first name or initial and last name, it covers:
A "User name or email address in combination with a password or security questions and answers that would permit access to an online account" is covered too.
Any of those elements without a name is covered where it is not rendered unusable and is enough to commit identity theft.
Notice is owed when "the personal information was not secured." Secured "means encrypted in a manner that meets or exceeds the national institute of standards and technology standard" or otherwise rendered unreadable.
"Notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm."
Seattle and Spokane teams that send files carrying full birth dates to counterparties can run that exchange through one room.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark is a per-room setting, on by default. Counterparties confirm their email with a six-digit code and need no account, groups see only their folders, and the chained activity log exports as CSV.
Checked against Washington's published law on November 2, 2026. This is general information, not legal advice.
